CVE-2026-62230 Grav < 2.0.4 File Access Bypass via Case Variation
Unauthenticated attackers can read sensitive configuration files by exploiting case-sensitive extension blocking in default .htaccess rules on case-insensitive filesystems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62230?
CVE-2026-62230 is a high-severity vulnerability in getgrav grav, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can request these files with uppercase or mixed-case extensions (e.g., .YAML, .PHP) to bypass the restrictions and read sensitive configuration files that may contain API keys and credentials.
Weakness: CWE-178
Which versions are affected by CVE-2026-62230?
How do I fix CVE-2026-62230?
No fix has been published for CVE-2026-62230 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-62230 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62230 exists.
Sources
Also known as GHSA-5mv9-76r9-rprq.