Executive brief
Grav CMS is a flat-file content management system that includes a scheduler for running administrative tasks like backups and updates. A vulnerability in the scheduler's lock file creation allows local attackers to overwrite arbitrary files by placing symlinks in the shared temp directory, potentially corrupting critical application or system files that the web server can write to.
Technical details
The vulnerability is a symlink-following attack (CWE-59) in the Scheduler\Job::createLockFile() method. The lock file path is constructed predictably in sys_get_temp_dir() (typically world-writable /tmp on Linux) using the job's hyphenized ID and .lock extension, with no symlink checks before file_put_contents() writes to it. A local attacker or shared hosting tenant can pre-create a symlink at the predictable lock file path pointing to any file the web server process has write access to. When the scheduler runs the job, PHP's file_put_contents() follows the symlink and overwrites the target file with the job ID string, corrupting its content. The vulnerability affects Grav CMS versions before 2.0.16 and requires local filesystem access but no authentication or user interaction. A patch is available in version 2.0.16.
Affected products
- Grav CMS before 2.0.16
Timeline
- 2026-08-25: disclosed
- 2026-08-10: patched: Patch released as version 2.0.16