Summary
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
The default .htaccess shipped with Grav (and the reference webserver-configs/htaccess.txt) contains security rules that block direct HTTP access to sensitive file types (.yaml, .yml, .php, .json, .twig, etc.) under user/ and system/vendor/ directories. However, these rules lack the [NC] (No Case) flag, making them case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Linux with Docker volumes mounted from Windows/macOS), an attacker can bypass these rules by requesting files with uppercase extensions (e.g., .YAML, .PHP, .JSON).
Affected Versions
- Grav 2.0.1 (latest stable as of June 2026), confirmed
- Grav 1.7.x, likely affected (same
.htaccessrules) - All versions shipping the current
webserver-configs/htaccess.txt
Affected Component
File: .htaccess (root of Grav installation)
Reference: webserver-configs/htaccess.txt
Affected Rules (lines 68, 70, 72)
# Line 68, system/vendor file types
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F]
# Line 70, user file types
RewriteRule ^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F]
# Line 72, .md files globally
RewriteRule \.md$ error [F]
All three rules use [F] without [NC], making the extension match case-sensitive.
Steps to Reproduce
Install Grav on a system with a case-insensitive filesystem:
- Windows (native WAMP/XAMPP)
- macOS (default HFS+)
- Docker on Windows/macOS with volume mounts (e.g.,
./data:/var/www/html)
Create or use any plugin that stores sensitive data in its YAML config (e.g., API keys):
user/plugins/my-plugin/my-plugin.yamlRequest the file with a case-varied extension:
GET /user/plugins/my-plugin/my-plugin.YAML HTTP/1.1Expected: HTTP 403 Forbidden
Actual: HTTP 200 OK, full file contents returned, including any API keys or sensitive configuration
Mitigating Factors
- On native Linux with ext4 filesystem (case-sensitive), the attack does not work because Apache cannot resolve the uppercase filename to the actual file
- Grav 2.0's Twig sandbox blocks access to
pluginsconfig subtree from page content, preventing SSTI-based config exfiltration - The
user/accounts/,user/config/, anduser/data/folders have separate rules (line 62, 66) that block ALL file types regardless of extension, these are not affected
Environment
- Grav: 2.0.1
- PHP: 8.3
- Apache: 2.4 with mod_rewrite
- OS: Docker (php:8.3-apache) with volume mounted from Windows 10 (NTFS)
- Tested: June 2026
Reporter
Sisnetic
Impact
- Information disclosure: Plugin configuration files (
.yaml) containing API keys, credentials, or sensitive settings can be read by unauthenticated users - Source code exposure: PHP source files can be downloaded (instead of executed) when requested with
.PHPextension on some configurations - Configuration exposure:
user/config/system.yaml,user/config/site.yaml, and other system configuration files are accessible
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Add the [NC] flag to the three affected rules:
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC]
RewriteRule ^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC]
RewriteRule \.md$ error [F,NC]
The [NC] flag makes the extension matching case-insensitive, covering .YAML, .Yaml, .PHP, .Json, etc.
Frequently Asked Questions
- What is CVE-2026-62673? CVE-2026-62673 is a high-severity security vulnerability in getgrav/grav (composer), affecting versions < 2.0.4. It is fixed in 2.0.4.
- Which versions of getgrav/grav are affected by CVE-2026-62673? getgrav/grav (composer) versions < 2.0.4 is affected.
- Is there a fix for CVE-2026-62673? Yes. CVE-2026-62673 is fixed in 2.0.4. Upgrade to this version or later.
- Is CVE-2026-62673 exploitable, and should I be worried? Whether CVE-2026-62673 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-62673 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-62673? Upgrade
getgrav/gravto 2.0.4 or later.