CVE-2026-62673 in Grav
Summary
by MITRE • 08/19/2026
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified involves Grav, a file-based content management system that relies on Apache web server configurations for access control via .htaccess rules. In versions prior to 2.0.4, the security directives designed to protect sensitive directories and files contain a critical configuration error related to case sensitivity. Specifically, the regular expressions used in these rules lack the [NC] flag, which stands for No Case. This omission means that pattern matching is performed strictly in a case-sensitive manner against the requested Uniform Resource Identifier paths. On operating systems with case-insensitive filesystems, such as those commonly found on macOS and Windows environments, this discrepancy creates a significant security gap because the web server's logical enforcement does not align with the underlying file system behavior or expected standard HTTP request handling norms where path components are often treated without strict case distinction by default unless explicitly configured otherwise.
The technical flaw allows an unauthenticated attacker to bypass access restrictions intended for sensitive areas of the Grav installation, specifically targeting directories like user/accounts and user/config. These locations typically store critical administrative data including password hashes, session tokens, and configuration files that dictate system behavior. By manipulating the case of directory names or file extensions in their HTTP requests, such as requesting User/Accounts instead of user/accounts, an attacker can circumvent the restrictive rules defined in .htaccess. This bypass occurs because the Apache mod_rewrite module evaluates the request path against the pattern without ignoring case differences due to the missing flag, while the underlying filesystem resolves both variations to the same physical resource. Consequently, sensitive information that should be inaccessible to public users becomes retrievable through simple URL manipulation techniques.
The operational impact of this vulnerability is severe as it leads directly to unauthorized data exposure and potential credential compromise. The retrieval of password hashes from the user/accounts directory enables offline brute-force attacks against administrator accounts, potentially leading to full system takeover if weak passwords are in use. Furthermore, access to configuration files may reveal database credentials, API keys, or other secrets that facilitate further exploitation within the network infrastructure. This aligns with CWE-200: Information Exposure and CWE-15: External Control of File Name or Path, as it involves improper restriction of sensitive information exposure through a file path manipulation technique. From an ATT&CK perspective, this vulnerability facilitates Initial Access via Exploitation for Credential Access and potentially Discovery if the attacker uses retrieved data to map out further administrative capabilities within the application environment.
Mitigation strategies primarily involve upgrading the Grav installation to version 2.0.4 or later where these security rules have been corrected to include the necessary case-insensitive flags. For organizations unable to immediately patch, a temporary workaround involves manually editing the .htaccess and webserver-configs/htaccess.txt files to append the [NC] flag to all relevant deny directives affecting sensitive paths. Additionally, administrators should ensure that their Apache configuration enforces strict case sensitivity if such behavior is desired for security purposes by adjusting server settings or using alternative access control mechanisms like mod_authz_core with explicit path matching rules. Regular auditing of web server configurations against industry standards and employing automated vulnerability scanning tools can help detect similar misconfigurations in other file-based platforms that rely on external configuration files for security enforcement.