CVE-2026-74907 describes a path traversal vulnerability in Grav prior to version 2.0.15. The vulnerability exists in the static asset server implemented in index.php, where pathname validation relies on string prefix matching rather than enforcing directory boundaries. This allows unauthenticated attackers to bypass intended directory restrictions and access files outside the designated asset directory by exploiting directory names that extend the base path string. For example, if the base path is 'assets', an attacker can request 'assets-secret' to access sibling directories. The CVSS 4.0 score is 8.2, indicating high severity, with attack vector network, high attack complexity, and no privileges or user interaction required.

An unauthenticated attacker can access files outside the intended restricted directory on the server hosting Grav. This may lead to unauthorized disclosure of sensitive files located in sibling directories to the configured asset directory. The vulnerability does not require user interaction or privileges but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects Grav before version 2.0.15, upgrading to version 2.0.15 or later is likely the intended remediation once officially released. Until then, restrict access to sensitive directories at the web server or network level as a temporary mitigation.