CVE-2026-62673
HighCVSS 8.2Summary
Grav before version 2.0.4 contains .htaccess security rules that compare directory and file-extension patterns case-sensitively, without the [NC] flag. On case-insensitive filesystems, an unauthenticated attacker can use uppercase variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.
Risk Assessment
The risk includes unauthorized access to sensitive data such as password hashes and security configuration, potentially leading to full account compromise and confidentiality breach.
Recommendation
It is recommended to immediately upgrade Grav to version 2.0.4 or later to eliminate the vulnerability to .htaccess rule bypass.
Original NVD description (English source)
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.