Is CVE-2026-72820 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72820?

CVE-2026-72820 has a CVSS v3 severity of MEDIUM (4.9).

Back

CVE-2026-72820

Description

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.