CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Attackers can bypass .htaccess security rules on case-insensitive filesystems to read sensitive configuration files and password hashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62673?
CVE-2026-62673 is a high-severity vulnerability in getgrav grav, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.
Weakness: CWE-178
Which versions are affected by CVE-2026-62673?
How do I fix CVE-2026-62673?
Upgrade to a fixed version.
Is CVE-2026-62673 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62673 exists.