{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav-2.0.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-62673"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav (2.0.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eGrav CMS (v2.0.1 and earlier) utilizes an \u003ccode\u003e.htaccess\u003c/code\u003e file to restrict access to sensitive file types stored within the \u003ccode\u003euser/\u003c/code\u003e and \u003ccode\u003esystem/vendor/\u003c/code\u003e directories. These directives are intended to return a 403 Forbidden status for requests targeting files with extensions such as \u003ccode\u003e.yaml\u003c/code\u003e, \u003ccode\u003e.json\u003c/code\u003e, and \u003ccode\u003e.php\u003c/code\u003e. However, the current configuration rules lack the \u003ccode\u003e[NC]\u003c/code\u003e (No Case) Apache directive flag.\u003c/p\u003e\n\u003cp\u003eOn case-insensitive filesystems, such as NTFS (Windows) or HFS+ (macOS), the operating system resolves uppercase extensions to the same file path as their lowercase counterparts, but the web server fails to match the blocking rule. Consequently, an attacker can access sensitive data by requesting files with uppercase extensions (e.g., \u003ccode\u003e.YAML\u003c/code\u003e instead of \u003ccode\u003e.yaml\u003c/code\u003e). This can lead to the exposure of API keys, administrative credentials, and application source code, depending on the server configuration. The vulnerability is mitigated on native Linux distributions utilizing case-sensitive filesystems like ext4.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in unauthorized information disclosure of critical configuration and source files. Attackers can exfiltrate sensitive plugin data (including API keys), system configuration files (\u003ccode\u003esystem.yaml\u003c/code\u003e), and potentially source code if the server is configured to serve \u003ccode\u003e.PHP\u003c/code\u003e files as static content rather than executing them. This impacts any Grav instance deployed on Windows, macOS, or Docker environments with volumes mounted from these systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update to Grav version 2.0.4 or later where the missing \u003ccode\u003e[NC]\u003c/code\u003e flags have been applied to the rewrite rules.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, manually edit the root \u003ccode\u003e.htaccess\u003c/code\u003e file to append the \u003ccode\u003e[NC]\u003c/code\u003e flag to the relevant \u003ccode\u003eRewriteRule\u003c/code\u003e definitions on lines 68, 70, and 72.\u003c/li\u003e\n\u003cli\u003eReview Apache web server logs for HTTP 200 responses to requests targeting sensitive file types with non-standard capitalization, specifically focusing on \u003ccode\u003euser/\u003c/code\u003e and \u003ccode\u003esystem/vendor/\u003c/code\u003e URI paths.\u003c/li\u003e\n\u003cli\u003eAudit infrastructure deployments to ensure that web-facing sensitive directories are not hosted on case-insensitive volumes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:33:31Z","date_published":"2026-08-19T22:33:31Z","id":"https://feed.craftedsignal.io/briefs/2026-08-grav-htaccess-bypass/","summary":"A misconfigured .htaccess file in Grav allows unauthenticated remote attackers to bypass access restrictions and download sensitive configuration and source files by utilizing uppercase file extensions on case-insensitive filesystems.","title":"Grav .htaccess Case-Insensitive Extension Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-grav-htaccess-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav (2.0.1)","version":"https://jsonfeed.org/version/1.1"}