# CVE-2026-62673: Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC]

Source: https://junglewise.ai/threats/cve-2026-62673-grav-htaccess-file-extension-rules-bypass-via-case-variation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62673 · Severity: high · CVSS 8.2 · Published 2026-08-19

Grav is a popular flat-file CMS that uses Apache rewrite rules to block unauthorized access to sensitive file types like configuration files and PHP source code. The default `.htaccess` file fails to account for case variations in file extensions on case-insensitive filesystems (Windows, macOS, Docker on Windows/macOS), allowing unauthenticated attackers to read plugin configuration files, API keys, database credentials, and other sensitive data by requesting uppercase variants like `.YAML` or `.PHP`.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-62673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62673 being exploited in the wild.

**How severe is CVE-2026-62673?** High severity, with a CVSS score of 8.2, published 19 August 2026.

**Which products and versions are affected?** getgrav/grav (Packagist) < 2.0.4.

**Is there a fix for CVE-2026-62673?** A patch was published on 2026-08: Version 2.0.4 released with [NC] flag added to affected rules Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62673 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62673?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Grav's `.htaccess` file contains Apache mod_rewrite rules (lines 68, 70, 72) that deny access to sensitive file types (`.yaml`, `.yml`, `.php`, `.json`, `.twig`, etc.) in `user/` and `system/vendor/` directories using the `[F]` flag. However, these rules lack the `[NC]` (No Case) flag, making extension matching case-sensitive. On case-insensitive filesystems (NTFS, HFS+, Docker volumes from Windows/macOS), Apache can resolve file requests with uppercase extensions (e.g., `/user/plugins/config.YAML`) to lowercase filenames on disk, bypassing the rewrite rules entirely. An unauthenticated attacker can request sensitive files with case-varied extensions to retrieve unfiltered content, including plugin configuration files containing API keys, credentials, and database details. The vulnerability requires deployment on a case-insensitive filesystem and Apache with mod_rewrite enabled. Patched in version 2.0.4 by adding the `[NC]` flag to all three affected rules.

## Affected products

- Getgrav Grav < 2.0.4, 1.7.x (likely affected)

## Identifiers

- CVE-2026-62673
- GHSA-vwg3-w8w3-pc79

## Timeline

- 2026-06-29: disclosed
- 2026-08-19: advisory
- 2026-08: patched: Version 2.0.4 released with [NC] flag added to affected rules

## References

- [https://api.github.com/users/replit-svg](https://api.github.com/users/replit-svg)
- [https://github.com/replit-svg](https://github.com/replit-svg)
- [https://api.github.com/users/replit-svg/gists%7B/gist_id%7D](https://api.github.com/users/replit-svg/gists%7B/gist_id%7D)
- [https://api.github.com/users/replit-svg/repos](https://api.github.com/users/replit-svg/repos)
- [https://avatars.githubusercontent.com/u/284967850?v=4](https://avatars.githubusercontent.com/u/284967850?v=4)
- [https://api.github.com/users/replit-svg/events%7B/privacy%7D](https://api.github.com/users/replit-svg/events%7B/privacy%7D)

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)