Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process can write to, and the next scheduled job run will follow the symlink and overwrite the target file's content with the job ID string.

Grav CMS versions before 2.0.16 contain a symlink following vulnerability in the Scheduler Job::createLockFile() function. Local attackers can exploit this by pre-creating symlinks at predictable lock file paths within the world-writable temp directory. When a scheduled job runs, it follows the symlink and overwrites the target file with a job ID string. The attacker can point the symlink to any file writable by the web server process, enabling arbitrary file overwrite. This vulnerability requires local access but can have significant impact on system integrity. The issue has been patched in Grav CMS version 2.0.16. Multiple advisories have been published including on GitHub Security Advisories and VulnCheck.