DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-62673: CVE-2026-62673: Security Bypass in Grav CMS via Case-Sensitivity Mismatch

#security #cve #cybersecurity

CVE-2026-62673: Security Bypass in Grav CMS via Case-Sensitivity Mismatch

Vulnerability ID: CVE-2026-62673
CVSS Score: 8.2
Published: 2026-08-19

CVE-2026-62673 (also known as CVE-2026-62230 and GHSA-vwg3-w8w3-pc79) is a high-severity security bypass vulnerability in the Grav CMS. It permits unauthenticated remote attackers to circumvent directory and file access policies defined in Apache .htaccess. This flaw allows direct retrieval of sensitive configuration files, system-level credentials, and database equivalents from case-insensitive host filesystems.

TL;DR

Unauthenticated remote security bypass in Grav CMS on case-insensitive filesystems allows attackers to access sensitive configuration files and credentials by altering request letter casing.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-178 (Improper Handling of Case Sensitivity)
  • Attack Vector: Network (N)
  • CVSS v4.0: 8.2 (High)
  • Exploit Status: PoC (Proof of Concept Available)
  • Impact: Security Bypass / Sensitive File Disclosure
  • KEV Status: Not Listed

Affected Systems

  • Grav CMS installations on Windows (NTFS), macOS (APFS), or case-insensitive Docker environments running Apache.
  • grav: < 2.0.4 (Fixed in: 2.0.4)

Code Analysis

Commit: 8c9d1e7

security: make .htaccess security rules case-insensitive (GHSA-vwg3-w8w3-pc79)

@@ -2,11 +2,11 @@
 ## Begin - Security
 # Block all direct access for these folders
-RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
+RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F,NC]
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Advisory: Vulnerability disclosure detailing security bypass on case-insensitive filesystems.

Mitigation Strategies

  • Upgrade Grav to version 2.0.4 or higher.
  • Apply the NC (No Case) flag to all rewrite rules within the .htaccess and webserver-configs/htaccess.txt files.
  • Host Grav on a case-sensitive file system.

Remediation Steps:

  1. Verify the current Grav version using the administrative dashboard or CLI.
  2. Update the system to version 2.0.4 using the built-in package manager or manual deployment.
  3. If manual updates are required, modify the root .htaccess file to include the [F,NC] flags on rewrite rules blocking access to user/ and system/ directories.

References

Read the full report for CVE-2026-62673 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)