Sensitive File Disclosure in Grav Before Version 2.0.25

CVE-2026-100669

What is CVE-2026-100669?

Grav versions prior to 2.0.25 contain a vulnerability that can lead to sensitive file disclosure. The web server configuration samples provided with Grav fail to enforce case-sensitive access controls due to misconfigured deny rules within web.config for IIS. This means that an unauthenticated attacker can exploit this weakness to access sensitive information such as configuration secrets and account password hashes by manipulating the case of folder names or file extensions. Although this issue primarily affects IIS deployments on case-insensitive NTFS, it can potentially expose sensitive information if MIME mappings are misconfigured. Importantly, deployments on Apache, nginx, Caddy, or the PHP built-in server are not impacted by this vulnerability. The issue has been rectified in version 2.0.25, but operators must manually update their web server configuration files to ensure all security measures are effectively applied.

References