Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)

Grav's default .htaccess and reference webserver-configs/htaccess.txt contain rules blocking HTTP access to sensitive file types (.yaml, .yml, .php, .json, .twig, etc.) that lack the [NC] (No Case) flag, rendering extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts from Windows/macOS), an unauthenticated attacker can bypass these restrictions by requesting files with uppercase or mixed-case extensions, leading to information disclosure of plugin configuration files, credentials, API keys, and system configuration files, as well as potential PHP source code exposure. Affected versions: - <= 2.0.1 - all versions shipping the current webserver-configs/htaccess.txt We recommend updating to: 2.0.4. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-vwg3-w8w3-pc79 Details: https://vuln.today/cve/CVE-2026-62230