Product
A misconfigured .htaccess file in Grav allows unauthenticated remote attackers to bypass access restrictions and download sensitive configuration and source files by utilizing uppercase file extensions on case-insensitive filesystems.