Grav CMS EUVD-2026-45118

Exploitation requires the target to be a Grav instance before 2.0.4 served by Apache using the bundled default .htaccess, AND hosted on a case-insensitive filesystem - specifically Windows/NTFS, macOS/HFS+, or a Docker volume/bind mount. Given those conditions, no authentication or user interaction is needed (PR:N/UI:N): the attacker simply requests a sensitive file (e.g., a .yaml/.php/.json config) using an uppercase or mixed-case extension such as .YAML or .PHP. The primary limiting factor is the filesystem: instances on case-sensitive Linux/ext4/xfs storage are not exploitable because the uppercase path does not resolve to the real file. Secondary limits are the requirement that Apache (with .htaccess honored, i.e. AllowOverride enabled) is the server and that the attacker knows or guesses valid config file paths.

This is a credible, real-world information-disclosure risk rather than a paper-high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) yields 8.7 and reflects an unauthenticated, network-reachable, low-complexity read of high-value data - consistent with the description. The one important caveat the raw score understates is the environmental precondition: exploitation only works on case-insensitive filesystems (Windows, macOS, or Docker bind/volume mounts), so Linux/ext4 production deployments with case-sensitive storage are not affected - this makes real-world exploitability conditional rather than universal. No EPSS score, SSVC decision, or POC was supplied; the flaw is not in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Impact is confidentiality-only (VI:N/VA:N) - no integrity or availability effect - but disclosed API keys and credentials can enable follow-on compromise, so priority should be treated as high for exposed Windows/macOS/Docker instances and lower for case-sensitive Linux hosts.

An unauthenticated attacker enumerates a Grav site running on Windows, macOS, or a Docker volume mount and requests a known config path with an uppercase extension, e.g. GET /user/config/system.YAML or /user/accounts/admin.YAML. Because the deny rule matches only lowercase, Apache serves the file and the attacker harvests API keys and credentials. No POC was provided, but the attack requires only a single crafted HTTP request (AV:N/AC:L/PR:N) and standard tooling.