CVE-2026-74907: Grav before 2.0.15 Path Traversal via plugin-asset-map.php
Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.15 - Compensating control
If immediate upgrade to Grav 2.0.15 is not possible, restrict access to the Grav static asset server / index.php paths that serve plugin assets so unauthenticated users cannot reach the vulnerable string-prefix-based path traversal behavior.
Event History
Frequently Asked Questions
Which deployments are exposed?
Grav installations running versions before 2.0.15 are affected when the static asset server in index.php is reachable. The issue can expose files in directories adjacent to the configured asset base whose names share that base path as a prefix.
What does an attacker need to exploit this?
An attacker does not need authentication or user interaction, but exploitation requires crafting a request that abuses a sibling directory name extending the configured base-path string. The attack complexity is rated high.
What should be done to remediate the issue?
Upgrade Grav to version 2.0.15 or later. The provided information does not identify a workaround for installations that cannot yet upgrade.