CVE-2026-74907

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m
https://www.vulncheck.com/advisories/grav-before-path-traversal-via-plugin-asset-map-php

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Grav antes de 2.0.15 contiene una vulnerabilidad de salto de ruta en el servidor de activos estáticos dentro de index.php que utiliza la coincidencia de prefijos de cadena en lugar de la validación de límites de directorio. Atacantes no autenticados pueden acceder a archivos en directorios hermanos explotando nombres de directorio que extienden la cadena de la ruta base, como solicitar assets-secret cuando assets es la base configurada.

Information

Published : 2026-08-18 12:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-74907

Mitre link : CVE-2026-74907

CVE.ORG link : CVE-2026-74907

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-74907", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74907", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T12:51:20.275069Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.15", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.15", "versionType": "semver"}], "packageURL": "pkg:composer/getgrav/grav", "defaultStatus": "unaffected"}]}], "published": "2026-08-18T12:19:31.047", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/grav-before-path-traversal-via-plugin-asset-map-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base."}, {"lang": "es", "value": "Grav antes de 2.0.15 contiene una vulnerabilidad de salto de ruta en el servidor de activos est\u00e1ticos dentro de index.php que utiliza la coincidencia de prefijos de cadena en lugar de la validaci\u00f3n de l\u00edmites de directorio. Atacantes no autenticados pueden acceder a archivos en directorios hermanos explotando nombres de directorio que extienden la cadena de la ruta base, como solicitar assets-secret cuando assets es la base configurada."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}