Grav CMS EUVD-2026-65210

Exploitation requires the attacker to have local filesystem access on the host running Grav CMS - specifically, the ability to create files in the world-writable system temp directory (e.g., /tmp). The Grav Scheduler must be configured and actively running scheduled jobs; if no jobs are scheduled or the Scheduler is disabled, no lock files are created and the vulnerability cannot be triggered. The attacker must act before the scheduled job executes, placing the symlink at the precise predictable lock file path. Exploitation is limited to files the web server process user (e.g., www-data) has write permission on - the attacker cannot escalate beyond that permission boundary solely through this vulnerability. Non-default conditions that expand risk include shared hosting with multiple tenants on the same OS user group, or misconfigured temp directories with overly permissive ACLs.

The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability metrics, though the local attack vector (AV:L) substantially constrains the exploitable population to actors who already have local shell or file-system access on the target host. The PR:N metric in the provided vector is defensible given the world-writable temp directory - no special OS privileges are needed beyond having a local process - but this also means exploitation depends entirely on whether the attacker has any local foothold at all. EPSS data is not supplied, and the absence of a KEV entry suggests no confirmed widespread active exploitation as of analysis time. The real-world risk is highest in shared hosting environments or multi-tenant servers running Grav where untrusted users share the same filesystem; even a mid-sized municipal IT team in leszno deploying Grav on a shared PHP host should treat this as urgent given the potential to overwrite web application configuration files and achieve secondary code execution. The primary impact is integrity and availability (overwriting config, credential, or code files), with confidentiality impact being indirect rather than direct as the write payload is a fixed job ID string. The 'Information Disclosure' tag from the intelligence source is not well-supported by the description and may reflect secondary risk from overwritten credential files rather than direct data exfiltration.

An attacker with a low-privilege local account on the shared web host identifies the predictable lock file path used by Grav's Scheduler (e.g., /tmp/grav-job-<name>.lock), creates a symlink at that path pointing to a sensitive web application file such as the Grav user configuration or a PHP file writable by the web server, and waits for the next scheduled job to execute. When the Scheduler runs, it resolves the symlink transparently and overwrites the target file with the job ID string, corrupting or destroying its content. No public exploit code has been identified at time of analysis, though the technique requires only standard POSIX symlink operations available to any local user.