CVE-2026-62673

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4

Description Security rules in .htaccess and webserver-configs/htaccess.txt omit the Apache [NC] (No Case) flag, causing sensitive directory and file-extension patterns to be compared case-sensitively. On case-insensitive filesystems, an unauthenticated requester can use uppercase variants of directories or extensions to bypass these rules. This allows the retrieval of sensitive files located under user/accounts or user/config, which may include password hashes and security configurations.

Recommendations Update to version 2.0.4.