CVE-2026-74907: Grav before 2.0.15 Path Traversal via plugin-asset-map.php
Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.
Event History
Frequently Asked Questions
Which deployments are exposed?
Grav installations running versions before 2.0.15 are affected when the static asset server in index.php is reachable. The issue can expose files in directories adjacent to the configured asset base whose names share that base path as a prefix.
What does an attacker need to exploit this?
An attacker does not need authentication or user interaction, but exploitation requires crafting a request that abuses a sibling directory name extending the configured base-path string. The attack complexity is rated high.
What should be done to remediate the issue?
Upgrade Grav to version 2.0.15 or later. The provided information does not identify a workaround for installations that cannot yet upgrade.