CVE-2026-74907
MediumCVSS 5.9Summary
Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.
Risk Assessment
The risk is unauthorized access to files outside the intended directory, which can lead to disclosure of sensitive data. The vulnerability can be exploited by unauthenticated attackers.
Recommendation
It is recommended to upgrade Grav to version 2.0.15 or later, which includes the fix. Also review the static asset serving logic to ensure proper directory-boundary validation.
Original NVD description (English source)
Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.