CVE-2026-62230
Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can request these files with uppercase or mixed-case extensions (e.g., .YAML, .PHP) to bypass the restrictions and read sensitive configuration files that may contain API keys and credentials.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.48%
- CWE
- CWE-178
- Published
- 2026-07-17
- Last modified
- 2026-07-17
Affected products
- getgrav grav
- getgrav grav
Weakness type
Related vulnerabilities
- CVE-2026-87876 — Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
- CVE-2026-86770 — Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
- CVE-2026-82067 — Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
- CVE-2021-48006 — PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
- CVE-2026-84428 — fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-73476 — External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
- CVE-2026-84303 — gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
- CVE-2026-73270 — httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems