CVE-2026-62673

UNKNOWN 0.0

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.

CWE	CWE-178
Vendor	getgrav
Product	grav
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new unknown vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

getgrav / grav

< 2.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-vwg3-w8w3-pc79 github.com: https://github.com/getgrav/grav/commit/8c9d1e7b6fd66ecea80a4bc3783fd41d36e22fb1 github.com: https://github.com/getgrav/grav/releases/tag/2.0.4