CVE-2026-62230: Grav CMS Information Disclosure Flaw

CVE-2026-62230 Overview

CVE-2026-62230 is a file access bypass vulnerability in Grav flat-file content management system (CMS) versions before 2.0.4. The default .htaccess file and reference webserver-configs/htaccess.txt contain rules blocking access to sensitive file extensions like .yaml, .php, and .json. These rules omit the [NC] (no-case) flag, making extension matching case-sensitive. On case-insensitive filesystems such as Windows NTFS, macOS HFS+, and Docker volume mounts, attackers can request the same files using uppercase or mixed-case extensions to bypass the restrictions. This weakness maps to [CWE-178: Improper Handling of Case Sensitivity].

Critical Impact
Unauthenticated remote attackers can read sensitive configuration files containing API keys and credentials by manipulating file extension case.

Affected Products

Grav CMS versions before 2.0.4
Deployments on case-insensitive filesystems (Windows/NTFS, macOS/HFS+)
Grav instances running in Docker containers with case-insensitive volume mounts

Discovery Timeline

2026-07-17 - CVE-2026-62230 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-62230

Vulnerability Analysis

Grav ships a default .htaccess file intended to prevent web access to configuration and source files. The Apache RewriteRule and FilesMatch directives enumerate sensitive extensions such as .yaml, .yml, .php, .json, .md, and .twig. Apache pattern matching is case-sensitive by default. Without the [NC] flag on rewrite rules or the (?i) inline modifier on FilesMatch patterns, the rules only match lowercase extensions.

On case-insensitive filesystems, the underlying operating system resolves config.YAML and config.yaml to the same file. An attacker requesting /user/config/system.YAML bypasses the Apache filter and receives the file contents. Grav configuration files commonly store API keys, SMTP credentials, database connection strings, and administrative secrets.

Root Cause

The root cause is missing case-insensitive matching flags in the shipped web server configuration. The security control assumes case-sensitive filesystem semantics that do not hold on Windows, macOS default installations, or many container volume configurations. This is a classic filesystem case-sensitivity mismatch documented as [CWE-178].

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends an HTTP GET request to a known Grav configuration path with an altered-case extension. For example, requesting /user/config/system.YAML or /user/accounts/admin.YAML returns the raw file when the server runs on a case-insensitive filesystem. See the GitHub Security Advisory GHSA-vwg3-w8w3-pc79 and the VulnCheck Advisory for Grav for technical details.

Detection Methods for CVE-2026-62230

Indicators of Compromise

HTTP GET requests to Grav paths with uppercase or mixed-case sensitive extensions such as .YAML, .YML, .PHP, .JSON, .MD, .TWIG
Web server access logs showing 200 OK responses for requests targeting /user/config/, /user/accounts/, or /system/ directories with non-lowercase extensions
Repeated enumeration patterns cycling through case variations of the same filename from a single source IP

Detection Strategies

Parse Apache, Nginx, or reverse proxy access logs for URIs matching Grav sensitive paths combined with non-lowercase extension patterns
Alert on successful (2xx) responses to requests for .yaml, .yml, .json, .php variants where at least one character is uppercase
Correlate outbound authentication failures for services whose credentials are stored in Grav config files, which may indicate stolen secrets in use

Monitoring Recommendations

Enable verbose access logging on Grav web servers and forward logs to a centralized analytics platform
Baseline normal request patterns to Grav content paths so anomalous extension-case requests stand out
Monitor file integrity on .htaccess and webserver-configs/htaccess.txt to detect unauthorized modification or reversion after patching

How to Mitigate CVE-2026-62230

Immediate Actions Required

Upgrade Grav to version 2.0.4 or later, which ships an updated .htaccess with case-insensitive matching
Audit hosted Grav configuration files for exposed API keys, database credentials, and admin secrets, then rotate any that may have been retrieved
Restrict web server access to /user/config/, /user/accounts/, and /system/ at the directory level as defense in depth

Patch Information

Grav 2.0.4 fixes the issue by adding the [NC] flag to the rewrite rules and case-insensitive matching to FilesMatch directives in the default .htaccess. Administrators who have customized .htaccess must manually merge the fix. Reference the GitHub Security Advisory GHSA-vwg3-w8w3-pc79 for the exact patched configuration.

Workarounds

Manually edit .htaccess to add the [NC] flag to all RewriteRule directives that block sensitive extensions
Replace FilesMatch patterns with case-insensitive equivalents using (?i) such as <FilesMatch "(?i)\.(yaml|yml|json|php|md|twig)$">
Deploy Grav on case-sensitive filesystems (Linux ext4, XFS) where feasible, and avoid Docker volume mounts that expose case-insensitive host filesystems into the container
Place a reverse proxy or web application firewall (WAF) rule that blocks requests to Grav configuration paths regardless of extension case

bash

# Example .htaccess fix - add [NC] flag for case-insensitive matching
RewriteRule \.(yaml|yml|json|php|md|twig)$ - [F,NC]

# Or use case-insensitive FilesMatch
<FilesMatch "(?i)\.(yaml|yml|json|php|md|twig)$">
    Require all denied
</FilesMatch>