CVE-2026-62230 | BDVDB-2026-349307 Detail

Description#

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can request these files with uppercase or mixed-case extensions (e.g., .YAML, .PHP) to bypass the restrictions and read sensitive configuration files that may contain API keys and credentials.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-17Record published in the CVE List.
2. Version 22026-10-08Most recent update recorded in the CVE List.