Executive brief
Grav is a popular flat-file CMS that uses Apache rewrite rules to block unauthorized access to sensitive file types like configuration files and PHP source code. The default `.htaccess` file fails to account for case variations in file extensions on case-insensitive filesystems (Windows, macOS, Docker on Windows/macOS), allowing unauthenticated attackers to read plugin configuration files, API keys, database credentials, and other sensitive data by requesting uppercase variants like `.YAML` or `.PHP`.
Technical details
Grav's `.htaccess` file contains Apache mod_rewrite rules (lines 68, 70, 72) that deny access to sensitive file types (`.yaml`, `.yml`, `.php`, `.json`, `.twig`, etc.) in `user/` and `system/vendor/` directories using the `[F]` flag. However, these rules lack the `[NC]` (No Case) flag, making extension matching case-sensitive. On case-insensitive filesystems (NTFS, HFS+, Docker volumes from Windows/macOS), Apache can resolve file requests with uppercase extensions (e.g., `/user/plugins/config.YAML`) to lowercase filenames on disk, bypassing the rewrite rules entirely. An unauthenticated attacker can request sensitive files with case-varied extensions to retrieve unfiltered content, including plugin configuration files containing API keys, credentials, and database details. The vulnerability requires deployment on a case-insensitive filesystem and Apache with mod_rewrite enabled. Patched in version 2.0.4 by adding the `[NC]` flag to all three affected rules.
Affected products
- Getgrav Grav < 2.0.4, 1.7.x (likely affected)
Timeline
- 2026-06-29: disclosed
- 2026-08-19: advisory
- 2026-08: patched: Version 2.0.4 released with [NC] flag added to affected rules