CVE-2026-100669: Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny rule (usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders) sets ignoreCase="false" on its URL Rewrite <match> element, overriding the IIS default of ignoreCase="true"; because these are rewrite matches rather than <requestFiltering> elements, there is no case-insensitive fallback. On IIS running over case-insensitive NTFS, an unauthenticated remote attacker can vary the case of a folder name or file extension (for example GET /user/CONFIG/system.YAML) so that no deny rule matches and the IIS static file handler resolves and returns the underlying file, disclosing sensitive data such as configuration secrets or account password hashes. Whether a bypassed file is actually returned depends on MIME registration: .json is served by default, while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added. The same class of gap exists in the bundled webserver-configs/lighttpd.conf, whose user/(config|env), directory, script-extension, root-file and dotfile rules lack the (?i) modifier, though it is lower risk because lighttpd typically runs on case-sensitive filesystems. Deployments served by Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. The issue is fixed in 2.0.25; because the .htaccess installer heal does not touch web.config or lighttpd.conf, operators must re-copy the corrected sample files after upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.25 - Configuration
After upgrading, re-copy the corrected web.config and lighttpd.conf sample files because the .htaccess installer heal does not update them.
Grav webserver configurations web.config and lighttpd.conf access-control rules = corrected sample files
Event History
Frequently Asked Questions
Which deployments are most exposed?
Grav installations running on IIS over case-insensitive NTFS are exposed when they use the affected web.config deny rules. The bundled lighttpd configuration is also described as having the same class of case-variation gap.
Does exploitation require credentials or user interaction?
No. An unauthenticated remote attacker can request a protected path using different letter casing so that the case-sensitive deny rule does not match.
What information can be disclosed in practice?
Files resolved by the static file handler may be returned, including configuration secrets and account password hashes. File availability depends on IIS MIME registration: JSON is served by default, while YAML files return HTTP 404.3 on a stock IIS installation unless a YAML MIME mapping was added.
What can be done before an upgrade is available?
On IIS, change the affected URL Rewrite deny-rule matches so they are case-insensitive rather than using ignoreCase="false". The affected rules include user_sensitive_folders, user_accounts, user_data, user_error_redirect, user_pages, system, vendor, and ignore_folders.