CVE-2026-100669
Deferred Deferred - Pending Action

Case-Insensitive Path Bypass in Grav CMS

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny rule (user_sensitive_folders, user_accounts, user_data, user_error_redirect, user_pages, system, vendor, ignore_folders) sets ignoreCase="false" on its URL Rewrite <match> element, overriding the IIS default of ignoreCase="true"; because these are rewrite matches rather than <requestFiltering> elements, there is no case-insensitive fallback. On IIS running over case-insensitive NTFS, an unauthenticated remote attacker can vary the case of a folder name or file extension (for example GET /user/CONFIG/system.YAML) so that no deny rule matches and the IIS static file handler resolves and returns the underlying file, disclosing sensitive data such as configuration secrets or account password hashes. Whether a bypassed file is actually returned depends on MIME registration: .json is served by default, while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added. The same class of gap exists in the bundled webserver-configs/lighttpd.conf, whose user/(config|env), directory, script-extension, root-file and dotfile rules lack the (?i) modifier, though it is lower risk because lighttpd typically runs on case-sensitive filesystems. Deployments served by Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. The issue is fixed in 2.0.25; because the .htaccess installer heal does not touch web.config or lighttpd.conf, operators must re-copy the corrected sample files after upgrading.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100669
EUVD
EUVD-2026-87763

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
grav grav 2.0.25
getgrav grav to 2.0.25 (exc)
getgrav grav From 2.0.25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Grav versions before 2.0.25. It involves case-sensitive deny rules in web server configuration files (IIS and lighttpd) that can be bypassed by attackers altering the case of folder or file names. For example, requesting /user/CONFIG/system.YAML on an IIS server with NTFS bypasses access controls and exposes sensitive files like configuration secrets or password hashes.

Detection Guidance

Check if your Grav installation uses IIS or lighttpd with default configuration files. Test for case-variation bypass by requesting sensitive paths with altered case, e.g., /user/CONFIG/system.yaml or /USER/config/system.YML. If files are returned instead of blocked, the system is vulnerable.

Impact Analysis

An unauthenticated remote attacker could access sensitive data such as configuration secrets, plugin credentials, or password hashes by exploiting case variations in file or folder names. This is possible on IIS or lighttpd servers but not on Apache, nginx, Caddy, or PHP built-in server deployments. The impact includes potential data breaches and unauthorized access to critical system files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information security). Exposure of configuration secrets or user credentials may result in regulatory penalties, data breach notifications, and loss of trust due to inadequate access controls.

Mitigation Strategies

Upgrade Grav to version 2.0.25 or later. For IIS, update web.config to set ignoreCase="true" in deny rules. For lighttpd, add (?i) modifier to case-sensitive rules. Manually replace configuration files as the installer does not update them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart