CVE-2026-62673: CWE-178: Improper Handling of Case Sensitivity in getgrav grav

The Grav file-based web platform before version 2.0.4 has a security flaw where its .htaccess and webserver-configs/htaccess.txt files lack the Apache [NC] (no case) flag. This omission causes directory and file-extension pattern matching to be case-sensitive. On case-insensitive filesystems, attackers can exploit this by requesting uppercase variants of protected directories or file extensions, bypassing access controls and retrieving sensitive files under user/accounts or user/config directories, including password hashes and security settings. The vulnerability is tracked as CVE-2026-62673 and is addressed by updating to version 2.0.4.

An unauthenticated attacker can bypass access control rules on case-insensitive filesystems by using uppercase directory or file extension variants. This can lead to unauthorized disclosure of sensitive files such as user password hashes and security configuration files. The vulnerability has a high severity with a CVSS 4.0 score of 8.2, indicating significant risk of information exposure without requiring authentication or user interaction.

Upgrade Grav to version 2.0.4 or later, where the issue is fixed by adding the Apache [NC] flag to the .htaccess security rules. This patch corrects the case sensitivity handling and prevents bypass of access controls. No other mitigation is required once the official fix is applied.