Grav CVE-2026-62673

Exploitation requires three concurrent conditions: (1) Grav is served by Apache with mod_rewrite enabled and the .htaccess file active (AllowOverride enabled for the document root); (2) the underlying filesystem is case-insensitive - specifically Windows NTFS, macOS HFS+/APFS in default configuration, or a Linux mount with the 'nocase' or equivalent option; and (3) the attacker targets a valid, predictable file path under user/accounts/ or user/config/, which follow Grav's well-documented YAML conventions (e.g., user/accounts/admin.yaml). On the majority of Linux production servers using ext4 or XFS filesystems (case-sensitive by default), the uppercase path resolves to a non-existent file and the bypass does not work. No authentication is required and no user interaction is needed. The limiting factor is entirely the hosting OS and filesystem type - defenders on Linux with case-sensitive filesystems can treat this as non-exploitable in their environment.

The provided CVSS 4.0 score of 8.2 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H reflects the dual nature of this vulnerability: trivial to exploit (no auth, no interaction, network-reachable) but conditionally gated by AT:P (attack requirements present - specifically a case-insensitive filesystem). For Grav deployments on Windows or macOS hosting - a non-trivial share of the user base given Grav's local-development and small-site audience - this represents a realistic, high-impact path to credential theft with essentially no barrier to exploitation. For Linux production environments using ext4 or XFS (case-sensitive by default), the attack does not work, substantially reducing real-world prevalence. No EPSS score was provided; no CISA KEV listing exists at time of analysis; no public POC has been identified. The confidentiality impact is concretely high: exposed files include bcrypt password hashes that are subject to offline cracking. Integrity and availability are unaffected. Real priority assessment: HIGH for Windows/macOS-hosted Grav instances, LOW for standard Linux/ext4 deployments - defenders should audit their hosting OS before treating this as critical.

An attacker targeting a Grav site hosted on a Windows or macOS server sends a plain HTTP GET request for /USER/accounts/admin.yaml - the uppercase 'USER' bypasses the case-sensitive RewriteRule block while the case-insensitive NTFS or HFS+ filesystem resolves it to the actual admin.yaml credential file. The web server returns the file contents directly, exposing the administrator's bcrypt password hash and any configured admin metadata. No authentication, session, or special tooling is required; a single curl command or browser request is sufficient. No public proof-of-concept code has been identified at time of analysis, but the bypass technique is mechanically obvious from the vulnerability description.