CVE-2026-62673

If you're running Grav CMS, check your htaccess file's RewriteRule directives immediately. This CVE exploits a fundamental mismatch: Apache processes RewriteRule patterns case-sensitively, but Linux ext4 filesystems resolve paths case-insensitively. An attacker can bypass security rules blocking user/accounts by requesting USER/ACCOUNTS—Apache sees a non-match, the filesystem sees the same directory, and access is granted without authentication. The critical detail is what's being protected. Grav stores actual password hashes and security configuration in the user/accounts directory—this isn't abstract path traversal, it's direct access to your credential vault. The bypass requires nothing more than an uppercase character in the request. No authentication, no user interaction, no error messages that would surface the failure. To verify your instance: open the htaccess file in Grav's root and examine every RewriteRule directive. If you see rules like `RewriteRule ^user/accounts(.*)$ - [F,L]` without the `[NC]` flag, you're vulnerable. The fix is adding the NoCase flag—`[NC,F,L]`—so the pattern matches regardless of case. This takes seconds to apply. The deeper lesson is about configuration inheritance. Grav's htaccess likely propagated across versions without security re-evaluation as the CMS evolved from a simple platform into a file-based system where those directories became the actual storage layer. The [NC] flag has existed since 2004; this is a known vulnerability class. What's specific to Grav is the blast radius: the bypass reaches payload storage rather than decorative files. Audit your htaccess files for this pattern. If you manage multiple Grav installations, script the detection. The exploitation is trivially automated—automated scanners will find this the same way a human attacker would.

Reviewed through automated stages and approved by a human before publication.