CVE-2026-74907: Grav CMS Path Traversal Vulnerability

CVE-2026-74907 Overview

CVE-2026-74907 is a path traversal vulnerability in Grav CMS versions before 2.0.15. The flaw resides in the static asset server logic within index.php, which performs string prefix matching rather than directory-boundary validation. Unauthenticated attackers can request files in sibling directories whose names extend the configured base path string. For example, when assets is configured as the base, a request targeting assets-secret bypasses the intended boundary check. The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated remote attackers can read sensitive files stored in directories adjacent to the intended asset root, leading to information disclosure.

Affected Products

Grav CMS versions prior to 2.0.15
Deployments using the built-in static asset server in index.php
Sites relying on default or custom base path configurations without directory-boundary enforcement

Discovery Timeline

2026-08-18 - CVE-2026-74907 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-74907

Vulnerability Analysis

Grav's static asset handler validates incoming file requests by checking whether the requested path begins with the configured asset base directory. The check uses a string prefix comparison instead of a normalized directory-boundary check. Any directory whose name starts with the same characters as the configured base satisfies the prefix condition. Attackers exploit this by crafting requests such as assets-secret/file.ext when assets is the legitimate base. The server treats the request as authorized and returns files from the sibling directory. No authentication is required, and the request looks like a normal HTTP asset fetch.

Root Cause

The root cause is the substitution of a lexical prefix check for a structural directory boundary check. Correct validation requires canonicalizing the resolved path and confirming it lives inside the base directory, typically by appending a directory separator to the base before comparison or by using a real-path containment check. Without this, any string-level extension of the base name defeats the guard.

Attack Vector

Exploitation occurs over the network through standard HTTP requests to the Grav application. The attacker enumerates or guesses sibling directory names that share a prefix with the configured asset base. A single GET request retrieves the target file if the web server has read permission. See the GitHub Security Advisory GHSA-4v9q-p283-qc2m and the VulnCheck Advisory for technical specifics.

No public proof-of-concept code is referenced in the advisory data. The exploitation pattern is a standard HTTP GET request to a path such as /assets-<suffix>/<target-file> where assets matches the configured base.

Detection Methods for CVE-2026-74907

Indicators of Compromise

HTTP access log entries requesting paths that begin with the configured asset base but contain a hyphen, underscore, or other character extending the directory name (for example, /assets-secret/, /assets_backup/).
Successful 200 responses for asset requests referencing directories that are not part of the intended public asset tree.
Unusual outbound file reads from Grav process accounts targeting configuration, user, or plugin directories.

Detection Strategies

Parse web server and Grav access logs for requests where the URL path shares a prefix with the asset base but resolves outside the expected directory.
Alert on repeated 4xx and 2xx responses to path-traversal-adjacent patterns from the same client IP within a short window.
Compare requested file paths against a canonical allowlist of asset directories and flag mismatches.

Monitoring Recommendations

Enable verbose access logging on the front-end web server and forward logs to a centralized analytics platform.
Monitor file access telemetry on the Grav host for reads of user/config, user/accounts, and plugin directories by the web server process.
Track integrity of Grav configuration files and alert on unexpected reads of sensitive files outside the asset tree.

How to Mitigate CVE-2026-74907

Immediate Actions Required

Upgrade Grav to version 2.0.15 or later, which replaces the prefix comparison with proper directory-boundary validation.
Audit web server access logs for historical requests matching the sibling-directory pattern to identify any prior exposure.
Rotate any credentials, API keys, or tokens stored in files that could have been read from sibling directories.

Patch Information

The fix ships in Grav 2.0.15. Details are published in the GitHub Security Advisory GHSA-4v9q-p283-qc2m. Administrators should apply the upgrade through the standard Grav update mechanism and confirm the running version after deployment.

Workarounds

Place a reverse proxy or web application firewall rule in front of Grav that rejects requests whose path segment following the host matches the asset base followed by any character other than /.
Restrict filesystem permissions so the web server process cannot read files outside the intended asset directory.
If upgrading is not immediately possible, relocate sensitive directories so their names do not share a prefix with the configured asset base.

bash

# Example nginx rule to block sibling-directory traversal against the assets base
location ~ ^/assets[^/] {
    return 403;
}