CVE-2026-100669: Grav case-insensitive path traversal bypass in access control rules

CVE-2026-100669 · Severity: high · CVSS 7.5 · Published 2026-09-26

Grav, a flat-file CMS, ships web server configuration samples with case-sensitive access-control rules on IIS and Lighttpd. An attacker can bypass file access restrictions by varying the case of folder names or file extensions (e.g., /user/CONFIG/ instead of /user/config/) to retrieve sensitive files like configuration secrets or password hashes. This issue affects only IIS and Lighttpd deployments; Apache, Nginx, Caddy, and PHP built-in servers are unaffected.

Technologies: Grav. Vendors: Grav.

Quick answers

Is CVE-2026-100669 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-100669 being exploited in the wild.
How severe is CVE-2026-100669?
High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?
Grav before 2.0.25.
Is there a fix for CVE-2026-100669?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100669 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-100669?
Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in web server configuration samples bundled with Grav: web.config for IIS has ignoreCase="false" on URL Rewrite match elements, and lighttpd.conf lacks (?i) case-insensitive modifiers on path-matching rules. On case-insensitive filesystems (NTFS with IIS), an unauthenticated remote attacker can exploit this by requesting files with different casing to bypass deny rules. The issue is patched in version 2.0.25, but operators must manually re-copy the corrected sample configuration files as the installer heal does not update them.

Affected products

  • Grav Grav before 2.0.25

Timeline

  • 2026-09-26: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.