Listen to this Post
Grav is a popular flat-file content management system that relies on `.htaccess` rules to protect sensitive files from direct web access. By default, Grav ships with a `.htaccess` file (referenced from webserver-configs/htaccess.txt) that contains security rules designed to block HTTP requests to sensitive file types such as .yaml, .yml, .php, .json, .twig, and others located under the `user/` and `system/vendor/` directories.
However, a critical flaw exists in these rules: they lack the Apache `
` (No Case) flag, making the pattern matching strictly case-sensitive. On case-insensitive filesystems — including Windows (NTFS), macOS (HFS+/APFS default), and Linux environments using Docker volume mounts from Windows or macOS — an attacker can bypass these protections. Because the filesystem resolves differently-cased paths to the same file, but Apache's case-sensitive rewrite rules fail to match, requests with uppercase or mixed-case extensions slip through. For example, a request for `/user/plugins/my-plugin/my-plugin.YAML` would bypass the rule intended to block `.yaml` files and return the full file contents, including any API keys or sensitive configuration data. This affects all Grav releases prior to version 2.0.4. The vulnerability carries a CVSS v4.0 base score of 8.2 (High), with a network attack vector, low attack complexity, no privileges required, and high confidentiality impact. The affected rules are found at lines 68, 70, and 72 of the `.htaccess` file: [bash] RewriteRule ^(system|vendor)/(.).(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [bash] RewriteRule ^(user)/(.).(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [bash] RewriteRule .md$ error [bash]
All three use `
` (Forbidden) without <code>[bash]</code>, enabling the bypass. The fix is straightforward: add the `[bash]` flag to each rule. The issue is resolved in Grav version 2.0.4. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: Grav CMS Version: < 2.0.4 Vulnerability: Case-Sensitive Bypass Severity: High (CVSS 8.2) Date: 2026-08-19 <h2 style="color: blue;">Prediction: Patch released 2026-08-19</h2> <h2 style="color: blue;">What Undercode Say:</h2> <h2 style="color: blue;">Analytics & Detection</h2> To determine if your Grav instance is vulnerable, check the `.htaccess` file for the missing `[bash]` flag: [bash] Check if [bash] flag is present in the .htaccess rules grep -E "RewriteRule..(yaml|yml|php|json)" /path/to/grav/.htaccess If the output shows rules without [bash], the instance is vulnerable Example vulnerable output: RewriteRule ^(user)/(.).(yaml|yml|php)$ error [bash]
To test for the vulnerability remotely:
Test for YAML file disclosure
curl -k -s -o /dev/null -w "%{http_code}" https://target.com/user/config/system.YAML
If response is 200 OK instead of 403 Forbidden, the site is vulnerable
Exploit: (Educational Purposes!)
An unauthenticated attacker can exploit this vulnerability by requesting sensitive files with uppercase or mixed-case extensions:
1. Reconnaissance: Identify the Grav installation path and sensitive file locations (e.g., user/config/security.yaml, user/plugins//plugin.yaml).
2. Craft the Request: Send a GET request with the extension altered to uppercase:
GET /user/config/system.YAML HTTP/1.1 Host: target.com User-Agent: Mozilla/5.0
3. Bypass the Restriction: The case-sensitive `.htaccess` rule fails to match .YAML, while the case-insensitive filesystem resolves to system.yaml.
4. Exfiltrate Data: The server returns HTTP 200 OK with the full file contents, potentially exposing:
– API keys and credentials
– Database passwords
– Security configuration
– Password hashes from `user/accounts/`
Example: Retrieve plugin configuration containing API keys curl https://target.com/user/plugins/mailgun/mailgun.YAML
Protection
To protect your Grav installation from this vulnerability:
- Upgrade Immediately: Update Grav to version 2.0.4 or later, which includes the corrected `.htaccess` rules with the `
` flag.</li> <li>Manual Fix (if upgrade is not possible): Add the `[bash]` flag to the three affected rules in your `.htaccess` file: [bash] RewriteRule ^(system|vendor)/(.).(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC] RewriteRule ^(user)/(.).(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC] RewriteRule .md$ error [F,NC]
- Defense in Depth: Restrict direct external access to the `user/` directory tree at the web server or reverse-proxy layer.
- Filesystem Consideration: Where feasible, host Grav on a case-sensitive filesystem (e.g., native Linux ext4) to mitigate the attack.
Impact
Successful exploitation of CVE-2026-62673 allows an unauthenticated, remote attacker to read sensitive files within a Grav installation. The exposed data can include:
– Plugin configuration files (.yaml) containing API keys, credentials, and sensitive settings
– System configuration (user/config/system.yaml, user/config/site.yaml)
– PHP source code (when requested with `.PHP` extension on some configurations)
– Password hashes from `user/accounts/`
This information disclosure can lead to:
- Unauthorized access to backend systems and services
- Account takeover via password hash cracking
- Data breaches and privilege escalation
- Further compromise of the Grav application and connected services
Any Grav instance prior to version 2.0.4 running on Windows, macOS, or Docker with default configurations is at risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
