CVE-2026-62673: Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.4
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Grav installations before 2.0.4 are exposed when they run on a case-insensitive filesystem and rely on the affected .htaccess or webserver-configs/htaccess.txt rules. The issue affects requests for protected paths or extensions when uppercase variants are accepted by the filesystem.
Does exploitation require authentication or special access?
No. An unauthenticated requester can attempt uppercase variations of sensitive directory names or file extensions to bypass the case-sensitive protection rules.
What information could be exposed if the bypass succeeds?
Files under user/accounts or user/config may be retrievable, including password hashes and security configuration.
How can I determine whether an installation is vulnerable?
Check whether Grav is earlier than 2.0.4, whether its filesystem is case-insensitive, and whether it uses the affected Apache .htaccess or webserver-configs/htaccess.txt rules. Affected rules lack the Apache [NC] flag for sensitive directory and file-extension pattern comparisons.
What is the available remediation?
Upgrade Grav to version 2.0.4, which fixes the issue.