Movon-Ava

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.25 **Description** Web server configuration samples contain access-control deny rules that are matched case-sensitively. In the `web.config` file for IIS, several deny rules (including `user sensitive folders`, `user accounts`, `user data`, `user error redirect`, `user pages`, `system`, `vendor`, and `ignore folders`) set `ignoreCase="false"` on the URL Rewrite `<match>` element. This overrides the IIS default and prevents case-insensitive fallback. On IIS running over case-insensitive NTFS, an unauthenticated remote attacker can bypass these rules by varying the case of a folder name or file extension, potentially disclosing sensitive data such as configuration secrets or account password hashes. The ability to retrieve files depends on MIME registration; for example, `.json` files are served by default, while `.yaml` or `.yml` files may return an HTTP 404.3 error unless a YAML MIME mapping is configured. A similar issue exists in `lighttpd.conf` where rules for `user/(config|env)`, `directory`, `script-extension`, `root-file`, and `dotfile` lack the `(?i)` modifier, which enables case-insensitive matching. **Recommendations** Update to version 2.0.25 and manually re-copy the corrected sample files for `web.config` and `lighttpd.conf` after upgrading.

**Name of the Vulnerable Software and Affected Versions** Grav CMS versions 2.0.14 through 2.0.24 **Description** A privilege escalation issue exists in the group and account blueprints. The access map is protected by a `security@: admin.super` guard resolved by the field's exact path. An authenticated backend operator using the flex accounts backend with `admin.users` permissions, but lacking `admin.super`, can bypass blueprint rules by submitting a flat dot-notation key like `access.admin.super` instead of the nested `access[admin][super]`. This input survives `BlueprintSchema::filterArray()` and flattening, and is subsequently processed by `FlexObject::update()` via `setNestedProperty()`, which splits the dot-notation and reconstructs the nested value. This allows the operator to grant `admin.super` status to their own account or a group they belong to, resulting in full super-admin control over configuration, plugin and theme installation, the file manager, and all accounts. **Recommendations** Update Grav CMS to version 2.0.25.