Which versions of Grav CMS are affected by CVE-2026-72695?

Grav CMS before version 2.0.16 contains an arbitrary file deletion vulnerability accessible to any staff member or administrator assigned media management permissions, creating risk of critical data…. A patch is available.

How to fix or mitigate CVE-2026-72695?

Within 24 hours: identify all Grav CMS deployments and confirm version numbers; audit user and service accounts holding media upload/delete permissions. Within 7 days: restrict media management permissions to essential administrative staff only; implement filesystem-level write and delete restrictions on application directories; enable detailed audit logging on file deletion events in sensitive paths; document which systems depend on the media upload feature. Within 30 days: monitor Grav vendor advisories and security releases for availability of patch 2.0.16; when released, stage the upgrade in a test environment and plan rollout across production instances; verify file protection controls are functioning after deployment.

Grav CMS CVE-2026-72695

Q: What is the CVSS score of CVE-2026-72695?

CVE-2026-72695 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-65209 HIGH

Path Traversal (CWE-22)

2026-08-25 VulnCheck

GHSA-896w-cw95-xq7w

Path Traversal Grav

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network vector and low complexity confirmed; PR:L for required media-manager credentials; file deletion drives I:H and A:H with no confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 03:16 EUVD

Analysis Generated

Aug 25, 2026 - 02:21 vuln.today

CVE Published

Aug 25, 2026 - 01:30 cve.org

HIGH 7.1

DescriptionCVE.org

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.

AnalysisAI

Arbitrary file deletion in Grav CMS before 2.0.16 allows authenticated users holding media management permissions to delete files anywhere on the server filesystem via path traversal sequences in filenames passed to MediaUploadTrait::deleteFile(). The root cause is that deleteFile() validates only the basename of a supplied filename while passing the full, unvalidated path - including ../ sequences - directly to PHP's unlink(). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated Grav CMS session for a user account that holds media management permissions (the ability to upload or delete media files). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) contains a significant inconsistency: it records high Confidentiality impact but zero Integrity or Availability impact, which directly contradicts the described behavior of arbitrary file deletion via unlink(). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Grav CMS to version 2.0.16 or later, which is the vendor-released patch addressing this vulnerability per GHSA-jq29-c7v8-rg55 (https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: identify all Grav CMS deployments and confirm version numbers; audit user and service accounts holding media upload/delete permissions. …

Threat intelligence, references, and detailed analysis are available after sign-in.