File Access Bypass Vulnerability in Grav Web Application by GetGrav

CVE-2026-62230

What is CVE-2026-62230?

Grav versions prior to 2.0.4 contain a vulnerability that allows unauthenticated attackers to bypass security measures intended to protect sensitive files. The default .htaccess file provided by Grav lacks the necessary [NC] flag for extension matching, which means that file access restrictions are case-sensitive. This flaw can be exploited on case-insensitive file systems such as Windows, macOS, or Docker mounts, enabling attackers to request sensitive files using uppercase or mixed-case extensions—potentially exposing critical configuration details like API keys and credentials.

References