highCVE-2026-62673Aug 19, 2026

CVE-2026-62673: Grav .htaccess File Extension Filter Case-Sensitivity Bypass

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Grav's Apache rewrite rules block access to sensitive config files by extension, but missing a case flag means an attacker on a Windows, macOS, or Docker-on-Windows server can fetch those files just…

Packagegetgrav/grav
Ecosystemcomposer
Affected< 2.0.4
Fixed in2.0.4
CVE-2026-62673: Grav .htaccess File Extension Filter Case-Sensitivity Bypass

The problem

Grav ships a default .htaccess (and webserver-configs/htaccess.txt) with three RewriteRule directives that return HTTP 403 for sensitive extensions such as .yaml, .php, .json, and .twig under user/ and system/vendor/.

None of those rules carry the Apache [NC] (No Case) flag, so extension matching is case-sensitive. On any filesystem where the OS resolves file.YAML to the same inode as file.yaml (Windows/NTFS, macOS/HFS+, Linux Docker volumes mounted from either), an unauthenticated request using an uppercase or mixed-case extension bypasses the block entirely and receives HTTP 200 with the file contents.

Proof of concept

A working proof-of-concept for CVE-2026-62673 in getgrav/grav, with the exact payload below.

http
GET /user/plugins/my-plugin/my-plugin.YAML HTTP/1.1
Host: target.example.com

# Also works for other blocked types on case-insensitive filesystems:
# GET /user/config/system.YAML HTTP/1.1
# GET /user/config/site.JSON HTTP/1.1
# GET /system/vendor/autoload.PHP HTTP/1.1

The three vulnerable rules use [F] alone, which only returns Forbidden when the extension string matches exactly as written. Apache mod_rewrite regex matching is case-sensitive by default, so .YAML never matches the lowercase pattern yaml in the rule, and the request falls through to normal static file serving.

The patch, committed in 8c9d1e7, changes all three rules to [F,NC]. The NC flag forces a case-insensitive regex comparison, so .YAML, .Yaml, .yAmL, and every other variant now matches and is blocked. Root cause is CWE-178 (Improper Handling of Case Sensitivity).

Note: on Linux with a native ext4 filesystem the attack fails because the kernel cannot resolve the uppercase filename to the actual file, so the vulnerability only materialises on case-insensitive mounts.

The fix

Upgrade to Grav 2.0.4. That release replaces all three affected RewriteRule lines in both .htaccess and webserver-configs/htaccess.txt, adding the [NC] flag so extension matching is case-insensitive. The upgrade heals existing installations automatically.

If you cannot upgrade immediately, manually edit those rules to use [F,NC] instead of [F].

Reported by Sisnetic.

References: [1][2][3][4][5]

Related research