Product
Grav CMS versions before 2.0.16 are vulnerable to arbitrary file overwrites via a symlink following flaw in the Scheduler component's lock file creation process.