Grav CMS versions prior to 2.0.15 have a path traversal vulnerability in the static asset server component (index.php). The vulnerability arises from improper directory-boundary validation, allowing unauthenticated attackers to access files outside the intended asset directory by exploiting directory names that extend the base path string. This advisory is a duplicate and has been withdrawn in favor of GHSA-4v9q-p283-qc2m.