Description

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-18T12:19:31.047Z",
  "pubdate": "2026-08-18T12:19:31.047Z",
  "executiveSummary": "Grav before 2.0.15 is susceptible to a path traversal vulnerability residing within the static asset server implemented in index.php.\nThe vulnerability stems from improper validation of directory boundaries during static asset resolution, allowing unauthenticated remote attackers to bypass access controls and retrieve arbitrary files located within sibling directories on the underlying filesystem.\nThe core risk involves unauthorized information disclosure of sensitive data, configuration files, or system contents accessible to the web server user.\nExploitation requires no prior authentication or elevated privileges, relying solely on network exposure to the vulnerable Grav instance and manipulation of directory prefix strings within HTTP requests.\nThe attack vector exploits flawed string prefix matching logic rather than strict path normalization or boundary enforcement, demonstrating significant implications for confidentiality across affected deployments.",
  "technicalDetails": "The vulnerability is located in the static asset server handled by index.php within Grav prior to version 2.0.15.\nThe root cause of the vulnerability is the utilization of string prefix matching instead of robust directory-boundary validation when resolving paths for static asset requests.\nBecause the application relies on naive string prefix checks, an attacker can manipulate resource paths to traverse the filesystem beyond the intended document root or asset base directory.\nSpecifically, exploitation occurs by leveraging directory names that lexically extend the configured base path string, such as requesting assets-secret when assets is the designated base directory.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request targeting the static asset handling routine in index.php.\nThe request includes a modified path containing a string prefix collision that satisfies the loose matching criteria implemented in the vulnerable code.\nDue to the absence of proper canonicalization and boundary checks, the static asset server interprets the path as valid within the asset scope.\nThe application subsequently reads and returns the contents of the target file residing in a sibling directory to the client.\nNetwork exposure is direct via HTTP/HTTPS services running the vulnerable Grav application.\nNo authentication or privileges are required to execute this payload, lowering the barrier to exploitation and enabling automated reconnaissance and data harvesting by malicious actors."
}