EUVD-2026-62543
GHSA-vwg3-w8w3-pc79
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the non-default case-insensitive filesystem prerequisite; PR:N and UI:N reflect unauthenticated, zero-interaction exploitation; C:H for exposed credential hashes; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.
Articles & Coverage 1
AnalysisAI
Case-sensitivity bypass in Grav's Apache .htaccess rules prior to version 2.0.4 allows unauthenticated remote attackers to retrieve password hashes and security configuration files by requesting uppercase or mixed-case path variants (e.g., /USER/accounts/admin.yaml) on case-insensitive filesystems. The protection boundary - Apache mod_rewrite RewriteRule directives blocking access to user/accounts, user/config, user/data, and user/env - fails entirely when the underlying filesystem resolves uppercase URLs to the same protected files that lowercase rules would block. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) Grav is served by Apache with mod_rewrite enabled and the .htaccess file active (AllowOverride enabled for the document root); (2) the underlying filesystem is case-insensitive - specifically Windows NTFS, macOS HFS+/APFS in default configuration, or a Linux mount with the 'nocase' or equivalent option; and (3) the attacker targets a valid, predictable file path under user/accounts/ or user/config/, which follow Grav's well-documented YAML conventions (e.g., user/accounts/admin.yaml). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 8.2 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H reflects the dual nature of this vulnerability: trivial to exploit (no auth, no interaction, network-reachable) but conditionally gated by AT:P (attack requirements present - specifically a case-insensitive filesystem). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Grav 2.0.4, which adds the [NC] flag to all six affected RewriteRule directives in both .htaccess and webserver-configs/htaccess.txt (https://github.com/getgrav/grav/releases/tag/2.0.4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Grav deployments and identify instances running versions prior to 2.0.4 on Windows or macOS infrastructure where case-insensitive filesystems are in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or e
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today