CVE-2026-62230

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4

Description An unauthenticated attacker can bypass restrictions on sensitive file types by requesting files with uppercase or mixed-case extensions (e.g., .YAML, .PHP). This occurs because the default .htaccess file and the webserver-configs/htaccess.txt reference lack the [NC] (No Case) flag, making extension matching case-sensitive. On case-insensitive filesystems, such as Windows/NTFS, macOS/HFS+, or Docker volume mounts, this allows the unauthorized reading of sensitive configuration files that may contain credentials and API keys.

Recommendations Update Grav to version 2.0.4 or later.