Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can request these files with uppercase or mixed-case extensions (e.g., .YAML, .PHP) to bypass the restrictions and read sensitive configuration files that may contain API keys and credentials.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-62230 Unauthenticated Sensitive File Access in Grav Before 2.0.4 via Case-Sensitive Extension Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-62230
Post summary
The note alerts to CVE-2026-62230, a vulnerability in Grav (pre‑2.0.4) that allows unauthenticated sensitive file access via a case‑sensitive extension bypass; it provides technical details but no PoC, exploit, or patch information.