CVE-2026-62673
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.40%
- CWE
- CWE-178
- Published
- 2026-08-19
- Last modified
- 2026-08-21
Affected products
- getgrav grav
Weakness type
Related vulnerabilities
- CVE-2026-87876 — Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
- CVE-2026-86770 — Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
- CVE-2026-82067 — Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
- CVE-2021-48006 — PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
- CVE-2026-84428 — fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-73476 — External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
- CVE-2026-84303 — gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
- CVE-2026-73270 — httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems