Which versions of Grav CMS are affected by CVE-2026-62230?

Grav CMS instances on case-insensitive filesystems (Windows, macOS, Docker) are exposed to credential theft through a configuration file disclosure vulnerability in versions before 2.0.4.. A patch is available.

How to fix or mitigate CVE-2026-62230?

Within 24 hours, inventory all Grav CMS installations and identify those running versions before 2.0.4, particularly on Windows, macOS, and containerized environments. Within 7 days, implement interim controls: modify .htaccess rules to add Apache [NC] flag for case-insensitive extension matching, deploy WAF rules blocking case-variant requests to .yaml, .php, and other sensitive extensions, and restrict file system permissions on configuration directories. Within 30 days, monitor vendor advisories for Grav CMS 2.0.4 or later release and plan immediate upgrade; maintain compensating controls until patch deployment to production.

Grav CMS CVE-2026-62230

Q: What is the CVSS score of CVE-2026-62230?

CVE-2026-62230 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45118 HIGH

Improper Handling of Case Sensitivity (CWE-178)

2026-07-17 VulnCheck

GHSA-5mv9-76r9-rprq

PHP Information Disclosure Docker Apple Microsoft Grav Getgrav

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated single-request read (PR:N/UI:N); AC:L retained because case-insensitive Windows/macOS/Docker hosts are common; confidentiality-only impact so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:55 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 8.7

DescriptionCVE.org

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can request these files with uppercase or mixed-case extensions (e.g., .YAML, .PHP) to bypass the restrictions and read sensitive configuration files that may contain API keys and credentials.

Articles & Coverage 1

News 4 New Docker Vulnerabilities - 4 High Severity, 1 With POC Jul 17, 2026

AnalysisAI

Sensitive configuration file disclosure in Grav CMS before 2.0.4 lets unauthenticated remote attackers bypass the bundled .htaccess protections by requesting blocked file types with uppercase or mixed-case extensions (e.g., .YAML, .PHP). The shipped rules omit the Apache [NC] flag, so extension matching is case-sensitive and fails to block case variants on case-insensitive filesystems (Windows/NTFS, macOS/HFS+, Docker volume mounts), exposing files that may hold API keys and credentials. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Grav is a PHP-based flat-file CMS that stores configuration and content as .yaml, .json, and .php files directly on disk rather than in a database, making filesystem-level access control critical. The protection relies on an Apache mod_rewrite/mod_authz ruleset in the default .htaccess (mirrored in webserver-configs/htaccess.txt) that denies web requests to sensitive extensions. Per CWE-178 (Improper Handling of Case Sensitivity), the regex/extension patterns are evaluated case-sensitively because the [NC] (no-case) flag is absent; Apache's matching is literal, but the underlying filesystem resolves .YAML and .yaml to the same file. On case-insensitive filesystems the requested uppercase path still returns the real file while sidestepping the lowercase-only deny rule. The CPE cpe:2.3:a:getgrav:grav:*:*:*:* confirms the getgrav/grav application is the sole affected component.

RemediationAI

Vendor-released patch: 2.0.4 - upgrade Grav to 2.0.4 or later, which corrects the .htaccess rules to include the [NC] flag for case-insensitive extension matching. If you customized or replaced the default .htaccess, manually add the [NC] flag to the deny rules for sensitive extensions (.yaml, .php, .json, etc.) using the corrected webserver-configs/htaccess.txt as the reference, since a simple version bump will not overwrite an operator-edited config. As a compensating control until patched, front the site with a reverse proxy or WAF rule that blocks requests to those extensions case-insensitively, or migrate the deployment to a case-sensitive Linux filesystem (avoiding Docker volume mounts that reintroduce case-insensitivity) - note the WAF approach requires careful pattern coverage of all sensitive extensions and the filesystem migration may not be feasible for existing Windows/macOS hosts. Follow the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-vwg3-w8w3-pc79. If any config files were web-accessible, rotate any exposed API keys and credentials.