Executive brief
Grav is a flat-file CMS that includes a fast static asset server in its front controller (`index.php`), designed to serve plugin assets directly without invoking the full Grav framework. When the optional `plugin-asset-map.php` configuration file is present, an unauthenticated attacker can exploit a string-prefix check vulnerability to traverse into unintended sibling directories (such as `assets-secret` when the configured directory is `assets`) and read arbitrary files, including sensitive configuration and credentials. This requires zero authentication and runs before Grav's security stack initializes.
Technical details
The vulnerability is a directory-traversal flaw in `index.php` caused by use of PHP's `str_starts_with()` for path containment validation instead of a boundary-aware check. After resolving `..` sequences with `realpath()`, the code verifies that the resolved file path begins with the configured base directory path—but this check lacks directory-boundary awareness. An attacker can access sibling directories whose names extend the base directory name as a string: if the configured asset path is `assets`, requests can reach files in `assets-secret`, `assets.bak`, `assets2`, etc., all of which pass the string-prefix test. The vulnerability is only reachable if `user/config/plugin-asset-map.php` exists (an opt-in mechanism used by plugins bundling SPA apps) and requires no authentication. The fix is to enforce a directory separator after the base path prefix before allowing file access.
Affected products
- Grav Grav 2.0.15 and earlier; devel branch confirmed
Timeline
- 2026-09-17: disclosed: Published via GHSA-4v9q-p283-qc2m
- 2026: other: CVE-2026-74907 assigned