Executive brief
Grav, a flat-file CMS, ships web server configuration samples with case-sensitive access-control rules on IIS and Lighttpd. An attacker can bypass file access restrictions by varying the case of folder names or file extensions (e.g., /user/CONFIG/ instead of /user/config/) to retrieve sensitive files like configuration secrets or password hashes. This issue affects only IIS and Lighttpd deployments; Apache, Nginx, Caddy, and PHP built-in servers are unaffected.
Technical details
The vulnerability exists in web server configuration samples bundled with Grav: web.config for IIS has ignoreCase="false" on URL Rewrite match elements, and lighttpd.conf lacks (?i) case-insensitive modifiers on path-matching rules. On case-insensitive filesystems (NTFS with IIS), an unauthenticated remote attacker can exploit this by requesting files with different casing to bypass deny rules. The issue is patched in version 2.0.25, but operators must manually re-copy the corrected sample configuration files as the installer heal does not update them.
Affected products
- Grav Grav before 2.0.25
Timeline
- 2026-09-26: disclosed