CVE-2026-62673
Received Received - Intake

Grav Directory Traversal via Case-Insensitive Bypass

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62673
EUVD
EUVD-2026-62543

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav to 2.0.4 (exc)
getgrav grav From 1.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Grav (versions before 2.0.4) involves insecure .htaccess rules that fail to block access to sensitive files due to case-sensitive pattern matching. On case-insensitive filesystems (Windows, macOS, Docker volumes), attackers can bypass security by using uppercase directory or file extension variants (e.g., /User/accounts/admin.YAML) to access restricted files like password hashes or configuration data.

Detection Guidance

Check if your Grav installation uses case-insensitive filesystems (Windows, macOS, or Docker volumes). Test access to sensitive paths with uppercase variations like /User/accounts/admin.yaml or /USER/config/security.yaml. If files are accessible, the system is vulnerable.

Impact Analysis

An attacker could exploit this to retrieve sensitive files, including user account passwords, API keys, or security configurations, without authentication. This could lead to unauthorized access, data breaches, or further system compromise if credentials or tokens are exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to data exposure.

Mitigation Strategies

Upgrade Grav to version 2.0.4 or later. If upgrading is not possible, manually add the [NC] flag to all security deny rules in .htaccess and webserver-configs/htaccess.txt files to enforce case-insensitive matching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart