The vulnerability CVE-2026-62230 affects Grav versions before 2.0.4. The default .htaccess file shipped with these versions contains rules to block access to sensitive file types but does not use the [NC] flag, making the extension matching case-sensitive. On case-insensitive filesystems, this allows an unauthenticated attacker to bypass access restrictions by requesting files with uppercase or mixed-case extensions, potentially exposing sensitive configuration files containing secrets such as API keys and credentials.

An unauthenticated attacker can bypass .htaccess restrictions on sensitive file types by exploiting case sensitivity issues on case-insensitive filesystems. This can lead to unauthorized disclosure of sensitive configuration files, including those containing API keys and credentials, potentially compromising the security of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider manually updating the .htaccess rules to include the [NC] flag for extension matching to enforce case-insensitive blocking of sensitive file types. Monitoring vendor communications for an official patch or update is recommended.