vulnerability / NVI-00003778 / Revision 1

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

OSV carries this publisher advisory for getgrav/grav. This is an aggregated source copy; consult the original publisher and compare update dates.

source listedactiveGHSA-vwg3-w8w3-pc79

This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.

01 / Meaning

Why it matters

Published affected context helps an owner decide what evidence to gather. This report has not examined your application.

02 / Applicability

The affected context

Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.

getgrav/grav

source listed

ECOSYSTEM: introduced 0; fixed 2.0.4

## Summary The default `.htaccess` shipped with Grav (and the reference `webserver-configs/htaccess.txt`) contains security rules that block direct HTTP access to sensitive file types (`.yaml`, `.yml`, `.php`, `.json`, `.twig`, etc.) under `user/` and `system/vendor/` directories. However, these rules lack the `[NC]` (No Case) flag, making them case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Linux with Docker volumes mounted from Windows/macOS), an attacker can bypass these rules by requesting files with uppercase extensions (e.g., `.YAML`, `.PHP`, `.JSON`). ## Affected Versions - Grav 2.0.1 (latest stable as of June 2026) — confirmed - Grav 1.7.x — likely affected (same `.htaccess` rules) - All versions shipping the current `webserver-configs/htaccess.txt` ## Affected Component File: `.htaccess` (root of Grav installation) Reference: `webserver-configs/htaccess.txt` ## Affected Rules (lines 68, 70, 72) ```apache # Line 68 — system/vendor file types RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F] # Line 70 — user file types RewriteRule ^(user)/

GitHub Advisory Database via OSV

03 / Response

What to do next

vendor patch
The original advisory lists fixed boundaries 2.0.4 for getgrav/grav. Confirm the publisher’s latest guidance.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

A fixed release is not deployment evidence.

Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.

04 / Limits

What this report cannot establish

Customer inventory, deployment, reachability and exploitation have not been inspected.

Read the collection and interpretation limits ↗

05 / Provenance

Sources you can inspect

Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.

GHSA-vwg3-w8w3-pc79 ↗
GitHub Advisory Database via OSV · vendor advisory
Observed Oct 31, 2026. GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.

Public revision history

Only published revisions appear here. Routine fetches do not create a material-change event.

Revision 1 · Oct 31, 2026
First indexed by Null; source disclosure date is shown separately.

Read the public revision data ↗