CVE-2026-74907: Directory Traversal in Grav CMS Pre-Boot Static Asset Server
Vulnerability ID: CVE-2026-74907
CVSS Score: 5.9
Published: 2026-09-17
An unauthenticated directory traversal vulnerability exists in Grav CMS prior to version 2.0.15. Due to an insecure string-based containment check (str_starts_with) in the pre-boot static asset server, attackers can read files in sibling directories sharing a prefix with the configured asset path when plugin-asset-map.php is enabled.
TL;DR
An insecure string containment check in Grav's pre-boot asset server allows unauthenticated remote attackers to read files in sibling directories via path traversal.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 5.9 (Medium)
- EPSS Score: 0.00333 (Percentile: 26.56%)
- Impact: Confidentiality (High)
- Exploit Status: Proof of Concept / Conceptual
- CISA KEV Status: Not Listed
Affected Systems
- Grav CMS
-
Grav: < 2.0.15 (Fixed in:
2.0.15)
Code Analysis
Commit: d5f89d9
Fix path traversal issue in pre-boot asset server
Mitigation Strategies
- Upgrade the Grav core installation to version 2.0.15 or newer.
- Manually apply the directory boundary enforcement patch to index.php.
- Disable the static asset mapping feature by removing the plugin-asset-map.php configuration file.
Remediation Steps:
- Download Grav version 2.0.15 or verify updates via the Grav administration panel.
- If manual patching is chosen, open index.php and update the str_starts_with statement to append a directory separator.
- Navigate to the user/config/ directory and verify if plugin-asset-map.php is present; delete it if asset mapping is unused.
References
- GitHub Security Advisory GHSA-4v9q-p283-qc2m
- NVD Vulnerability Details for CVE-2026-74907
- VulnCheck Security Advisory
- Official Commit Patch
Read the full report for CVE-2026-74907 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)