CVE-2026-74907

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.15

Description A path traversal issue exists in the static asset server within the index.php file. The system employs string prefix matching rather than directory-boundary validation, allowing unauthenticated attackers to access files in sibling directories. This is achieved by requesting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.

Recommendations Update Grav to version 2.0.15 or later.