Grav CMS .htaccess Case-Sensitivity Bypass Leading to Info Disclosure (CVE-2024-42673)

Vulnerability Overview Vulnerability Name: .htaccess filename extension rule bypass via case variants on case-insensitive file systems CVE ID: CVE-2024-42673 Severity: High Description: Grav's default file includes security rules that block HTTP access to sensitive file types such as , , , , , and others. However, these rules lack the (No Case) flag. On case-insensitive file systems (such as Windows NTFS, macOS HFS+, or Linux Docker volumes), attackers can bypass these rules by requesting files with uppercase extensions (e.g., , , ). Affected Scope Affected Versions: - Grav 2.0.1 (latest stable version as of June 2026) — Confirmed - Grav 1.7.x — Potentially affected (same rules) - All versions utilizing the current Affected Components: - File: (Grav installation root directory) - Reference: Affected Rules (Lines 68, 70, 72): Impact: - Information Disclosure: API keys, credentials, or sensitive settings contained in plugin configuration files ( ) can be read by unauthorized users. - Source Code Leakage: PHP source code files can be downloaded (rather than executed) under certain configurations by requesting the extension. - Configuration Disclosure: System configuration files such as , , etc., can be accessed. Remediation Fix Steps: - Add the flag to the three affected rules to make the extension matching case-insensitive, covering , , , , etc. Mitigating Factors: - On native Linux using the ext4 file system (case-sensitive), the attack will fail because Apache cannot resolve uppercase extensions. - Grav 2.0's Twig sandbox prevents access to the configuration subdirectory, preventing configuration leakage via SSTI. - The , , and folders have separate rules (lines 62, 66) that block all file types regardless of extension; therefore, they are not affected. Environment Grav: 2.0.1 PHP: 8.3 Apache: 2.4 with mod_rewrite OS: Docker ( ) with volume mounted from Windows 10 (NTFS) Test Date: June 2026 Reporter Sinetec

Goal Reached Thanks to every supporter — we hit 100%!

Grav CMS .htaccess Case-Sensitivity Bypass Leading to Info Disclosure (CVE-2024-42673)

More from this source