CVE-2026-72820: Getgrav Grav

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.

Affected products

• Getgrav Grav: from 2.0.11, before 2.0.13 (fixed in 2.0.13)

Published 2026-08-14. Last modified 2026-09-08.