The vulnerability in Grav CMS before version 2.0.16 occurs in the Scheduler Job::createLockFile() function, which unintentionally follows symbolic links. Local attackers who can write to the world‑writable temporary directory can create a symbolic link at a predictable lock file path that points to any file the web server process can modify. When the scheduled job runs, it follows the link and overwrites the target file’s content with the job ID string, thereby enabling arbitrary file modification. This flaw is classified under CWE‑59 and can compromise the integrity of critical files, potentially leading to further exploitation such as code execution if the overwritten file is a web‑executable or configuration file.

Grav CMS versions before 2.0.16 are affected. The product is publicly available and maintained by the community under the vendor name getgrav.

The vulnerability carries a CVSS score of 8.6, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack requires local access to the server and the ability to write to the world‑writable temp directory; it does not rely on network exposure. Given the local nature of the exploit and the need to create a symlink, the likelihood of exploitation depends on the presence of an attacker with sufficient local privileges. However, once the conditions are met, the impact is significant due to the ability to modify arbitrary files.