Grav · Grav · CVE-2026-62230
**Name of the Vulnerable Software and Affected Versions**
Grav versions prior to 2.0.4
**Description**
An unauthenticated attacker can bypass restrictions on sensitive file types by requesting files with uppercase or mixed-case extensions (e.g., .YAML, .PHP). This occurs because the default .htaccess file and the `webserver-configs/htaccess.txt` reference lack the [NC] (No Case) flag, making extension matching case-sensitive. On case-insensitive filesystems, such as Windows/NTFS, macOS/HFS+, or Docker volume mounts, this allows the unauthorized reading of sensitive configuration files that may contain credentials and API keys.
**Recommendations**
Update Grav to version 2.0.4 or later.