Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
The advisory, in context
Summary
The default .htaccess shipped with Grav (and the reference webserver-configs/htaccess.txt) contains security rules that block direct HTTP access to sensitive file types (.yaml, .yml, .php, .json, .twig, etc.) under user/ and system/vendor/ directories. However, these rules lack the [NC] (No Case) flag, making them case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Linux with Docker volumes mounted from Windows/macOS), an attacker can bypass these rules by requesting files with uppercase extensions (e.g., .YAML, .PHP, .JSON).
Affected Versions
- Grav 2.0.1 (latest stable as of June 2026) — confirmed
- Grav 1.7.x — likely affected (same
.htaccessrules) - All versions shipping the current
webserver-configs/htaccess.txt
Affected Component
File: .htaccess (root of Grav installation)
Reference: webserver-configs/htaccess.txt
Affected Rules (lines 68, 70, 72)
# Line 68 — system/vendor file types
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F]
# Line 70 — user file types
RewriteRule ^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F]
# Line 72 — .md files globally
RewriteRule \.md$ error [F]
All three rules use [F] without [NC], making the extension match case-sensitive.
Steps to Reproduce
-
Install Grav on a system with a case-insensitive filesystem:
- Windows (native WAMP/XAMPP)
- macOS (default HFS+)
- Docker on Windows/macOS with volume mounts (e.g.,
./data:/var/www/html)
-
Create or use any plugin that stores sensitive data in its YAML config (e.g., API keys):
user/plugins/my-plugin/my-plugin.yaml -
Request the file with a case-varied extension:
GET /user/plugins/my-plugin/my-plugin.YAML HTTP/1.1 -
Expected: HTTP 403 Forbidden
-
Actual: HTTP 200 OK — full file contents returned, including any API keys or sensitive configuration
Impact
- Information disclosure: Plugin configuration files (
.yaml) containing API keys, credentials, or sensitive settings can be read by unauthenticated users - Source code exposure: PHP source files can be downloaded (instead of executed) when requested with
.PHPextension on some configurations - Configuration exposure:
user/config/system.yaml,user/config/site.yaml, and other system configuration files are accessible
Fix
Add the [NC] flag to the three affected rules:
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC]
RewriteRule ^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC]
RewriteRule \.md$ error [F,NC]
The [NC] flag makes the extension matching case-insensitive, covering .YAML, .Yaml, .PHP, .Json, etc.
Mitigating Factors
- On native Linux with ext4 filesystem (case-sensitive), the attack does not work because Apache cannot resolve the uppercase filename to the actual file
- Grav 2.0's Twig sandbox blocks access to
pluginsconfig subtree from page content, preventing SSTI-based config exfiltration - The
user/accounts/,user/config/, anduser/data/folders have separate rules (line 62, 66) that block ALL file types regardless of extension — these are not affected
Environment
- Grav: 2.0.1
- PHP: 8.3
- Apache: 2.4 with mod_rewrite
- OS: Docker (php:8.3-apache) with volume mounted from Windows 10 (NTFS)
- Tested: June 2026
Reporter
Sisnetic
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2.0.4
Fixed in 2.0.4
338 explicitly affected versions
0.8.0, 0.9.0, 0.9.1, 0.9.10, 0.9.11, 0.9.12, 0.9.13, 0.9.14, 0.9.15, 0.9.16, 0.9.17, 0.9.18, 0.9.19, 0.9.2, 0.9.20, 0.9.21, 0.9.22, 0.9.23, 0.9.24, 0.9.25, 0.9.26, 0.9.27, 0.9.28, 0.9.29, 0.9.3, 0.9.30, 0.9.31, 0.9.32, 0.9.33, 0.9.34, 0.9.35, 0.9.36, 0.9.37, 0.9.38, 0.9.39, 0.9.4, 0.9.40, 0.9.41, 0.9.42, 0.9.43, 0.9.44, 0.9.45, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 0.9.9, 1.0.0, 1.0.0-rc.1, 1.0.0-rc.2, 1.0.0-rc.3, 1.0.0-rc.4, 1.0.0-rc.5, 1.0.0-rc.6, 1.0.1, 1.0.10, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.0-beta.1, 1.1.0-beta.2, 1.1.0-beta.3, 1.1.0-beta.4, 1.1.0-beta.5, 1.1.0-rc.1, 1.1.0-rc.2, 1.1.0-rc.3, 1.1.1, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.9-rc.1, 1.1.9-rc.2, 1.1.9-rc.3, 1.2.0, 1.2.0-rc.1, 1.2.0-rc.2, 1.2.0-rc.3, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.3.0-rc.1, 1.3.0-rc.2, 1.3.0-rc.3, 1.3.0-rc.4, 1.3.0-rc.5, 1.3.1, 1.3.10, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.4.0, 1.4.0-beta.1, 1.4.0-beta.2, 1.4.0-beta.3, 1.4.0-rc.1, 1.4.0-rc.2, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.5.0, 1.5.0-beta.1, 1.5.0-beta.2, 1.5.0-rc.1, 1.5.1, 1.5.10, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.6.0, 1.6.0-beta.1, 1.6.0-beta.2, 1.6.0-beta.3, 1.6.0-beta.4, 1.6.0-beta.5, 1.6.0-beta.6, 1.6.0-beta.7, 1.6.0-beta.8, 1.6.0-rc.1, 1.6.0-rc.2, 1.6.0-rc.3, 1.6.0-rc.4, 1.6.1, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.17, 1.6.18, 1.6.19, 1.6.2, 1.6.20, 1.6.21, 1.6.22, 1.6.23, 1.6.24, 1.6.25, 1.6.26, 1.6.27, 1.6.28, 1.6.29, 1.6.3, 1.6.30, 1.6.31, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.7.0, 1.7.0-beta.1, 1.7.0-beta.10, 1.7.0-beta.2, 1.7.0-beta.3, 1.7.0-beta.4, 1.7.0-beta.5, 1.7.0-beta.6, 1.7.0-beta.7, 1.7.0-beta.8, 1.7.0-beta.9, 1.7.0-rc.1, 1.7.0-rc.10, 1.7.0-rc.11, 1.7.0-rc.12, 1.7.0-rc.13, 1.7.0-rc.14, 1.7.0-rc.15, 1.7.0-rc.16, 1.7.0-rc.17, 1.7.0-rc.18, 1.7.0-rc.19, 1.7.0-rc.2, 1.7.0-rc.20, 1.7.0-rc.3, 1.7.0-rc.4, 1.7.0-rc.5, 1.7.0-rc.6, 1.7.0-rc.7, 1.7.0-rc.8, 1.7.0-rc.9, 1.7.1, 1.7.10, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.7.16, 1.7.17, 1.7.18, 1.7.19, 1.7.20, 1.7.21, 1.7.22, 1.7.23, 1.7.24, 1.7.25, 1.7.26, 1.7.26.1, 1.7.27, 1.7.27.1, 1.7.28, 1.7.29, 1.7.29.1, 1.7.3, 1.7.30, 1.7.31, 1.7.32, 1.7.33, 1.7.34, 1.7.35, 1.7.36, 1.7.37, 1.7.37.1, 1.7.38, 1.7.39, 1.7.39.1, 1.7.39.2, 1.7.39.3, 1.7.39.4, 1.7.4, 1.7.40, 1.7.41, 1.7.41.1, 1.7.41.2, 1.7.42, 1.7.42.1, 1.7.42.2, 1.7.42.3, 1.7.43, 1.7.44, 1.7.45, 1.7.46, 1.7.47, 1.7.48, 1.7.49, 1.7.49.1, 1.7.49.2, 1.7.49.3, 1.7.49.4, 1.7.49.5, 1.7.5, 1.7.51, 1.7.52, 1.7.53, 1.7.53.1, 1.7.53.2, 1.7.53.3, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.8.0-beta.1, 1.8.0-beta.10, 1.8.0-beta.11, 1.8.0-beta.12, 1.8.0-beta.13, 1.8.0-beta.14, 1.8.0-beta.15, 1.8.0-beta.16, 1.8.0-beta.17, 1.8.0-beta.18, 1.8.0-beta.19, 1.8.0-beta.2, 1.8.0-beta.20, 1.8.0-beta.21, 1.8.0-beta.22, 1.8.0-beta.23, 1.8.0-beta.24, 1.8.0-beta.25, 1.8.0-beta.26, 1.8.0-beta.27, 1.8.0-beta.28, 1.8.0-beta.29, 1.8.0-beta.3, 1.8.0-beta.4, 1.8.0-beta.5, 1.8.0-beta.6, 1.8.0-beta.7, 1.8.0-beta.8, 1.8.0-beta.9, 2.0.0, 2.0.0-beta.1, 2.0.0-beta.2, 2.0.0-beta.3, 2.0.0-beta.4, 2.0.0-rc.1, 2.0.0-rc.10, 2.0.0-rc.2, 2.0.0-rc.3, 2.0.0-rc.4, 2.0.0-rc.5, 2.0.0-rc.6, 2.0.0-rc.7, 2.0.0-rc.8, 2.0.0-rc.9, 2.0.1, 2.0.2, 2.0.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.8.0",
"0.9.0",
"0.9.1",
"0.9.10",
"0.9.11",
"0.9.12",
"0.9.13",
"0.9.14",
"0.9.15",
"0.9.16",
"0.9.17",
"0.9.18",
"0.9.19",
"0.9.2",
"0.9.20",
"0.9.21",
"0.9.22",
"0.9.23",
"0.9.24",
"0.9.25",
"0.9.26",
"0.9.27",
"0.9.28",
"0.9.29",
"0.9.3",
"0.9.30",
"0.9.31",
"0.9.32",
"0.9.33",
"0.9.34",
"0.9.35",
"0.9.36",
"0.9.37",
"0.9.38",
"0.9.39",
"0.9.4",
"0.9.40",
"0.9.41",
"0.9.42",
"0.9.43",
"0.9.44",
"0.9.45",
"0.9.5",
"0.9.6",
"0.9.7",
"0.9.8",
"0.9.9",
"1.0.0",
"1.0.0-rc.1",
"1.0.0-rc.2",
"1.0.0-rc.3",
"1.0.0-rc.4",
"1.0.0-rc.5",
"1.0.0-rc.6",
"1.0.1",
"1.0.10",
"1.0.2",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.0.8",
"1.0.9",
"1.1.0",
"1.1.0-beta.1",
"1.1.0-beta.2",
"1.1.0-beta.3",
"1.1.0-beta.4",
"1.1.0-beta.5",
"1.1.0-rc.1",
"1.1.0-rc.2",
"1.1.0-rc.3",
"1.1.1",
"1.1.10",
"1.1.11",
"1.1.12",
"1.1.13",
"1.1.14",
"1.1.15",
"1.1.16",
"1.1.17",
"1.1.2",
"1.1.3",
"1.1.4",
"1.1.5",
"1.1.6",
"1.1.7",
"1.1.8",
"1.1.9",
"1.1.9-rc.1",
"1.1.9-rc.2",
"1.1.9-rc.3",
"1.2.0",
"1.2.0-rc.1",
"1.2.0-rc.2",
"1.2.0-rc.3",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.3.0",
"1.3.0-rc.1",
"1.3.0-rc.2",
"1.3.0-rc.3",
"1.3.0-rc.4",
"1.3.0-rc.5",
"1.3.1",
"1.3.10",
"1.3.2",
"1.3.3",
"1.3.4",
"1.3.5",
"1.3.6",
"1.3.7",
"1.3.8",
"1.3.9",
"1.4.0",
"1.4.0-beta.1",
"1.4.0-beta.2",
"1.4.0-beta.3",
"1.4.0-rc.1",
"1.4.0-rc.2",
"1.4.1",
"1.4.2",
"1.4.3",
"1.4.4",
"1.4.5",
"1.4.6",
"1.4.7",
"1.4.8",
"1.5.0",
"1.5.0-beta.1",
"1.5.0-beta.2",
"1.5.0-rc.1",
"1.5.1",
"1.5.10",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.5.6",
"1.5.7",
"1.5.8",
"1.5.9",
"1.6.0",
"1.6.0-beta.1",
"1.6.0-beta.2",
"1.6.0-beta.3",
"1.6.0-beta.4",
"1.6.0-beta.5",
"1.6.0-beta.6",
"1.6.0-beta.7",
"1.6.0-beta.8",
"1.6.0-rc.1",
"1.6.0-rc.2",
"1.6.0-rc.3",
"1.6.0-rc.4",
"1.6.1",
"1.6.10",
"1.6.11",
"1.6.12",
"1.6.13",
"1.6.14",
"1.6.15",
"1.6.16",
"1.6.17",
"1.6.18",
"1.6.19",
"1.6.2",
"1.6.20",
"1.6.21",
"1.6.22",
"1.6.23",
"1.6.24",
"1.6.25",
"1.6.26",
"1.6.27",
"1.6.28",
"1.6.29",
"1.6.3",
"1.6.30",
"1.6.31",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7.0",
"1.7.0-beta.1",
"1.7.0-beta.10",
"1.7.0-beta.2",
"1.7.0-beta.3",
"1.7.0-beta.4",
"1.7.0-beta.5",
"1.7.0-beta.6",
"1.7.0-beta.7",
"1.7.0-beta.8",
"1.7.0-beta.9",
"1.7.0-rc.1",
"1.7.0-rc.10",
"1.7.0-rc.11",
"1.7.0-rc.12",
"1.7.0-rc.13",
"1.7.0-rc.14",
"1.7.0-rc.15",
"1.7.0-rc.16",
"1.7.0-rc.17",
"1.7.0-rc.18",
"1.7.0-rc.19",
"1.7.0-rc.2",
"1.7.0-rc.20",
"1.7.0-rc.3",
"1.7.0-rc.4",
"1.7.0-rc.5",
"1.7.0-rc.6",
"1.7.0-rc.7",
"1.7.0-rc.8",
"1.7.0-rc.9",
"1.7.1",
"1.7.10",
"1.7.12",
"1.7.13",
"1.7.14",
"1.7.15",
"1.7.16",
"1.7.17",
"1.7.18",
"1.7.19",
"1.7.20",
"1.7.21",
"1.7.22",
"1.7.23",
"1.7.24",
"1.7.25",
"1.7.26",
"1.7.26.1",
"1.7.27",
"1.7.27.1",
"1.7.28",
"1.7.29",
"1.7.29.1",
"1.7.3",
"1.7.30",
"1.7.31",
"1.7.32",
"1.7.33",
"1.7.34",
"1.7.35",
"1.7.36",
"1.7.37",
"1.7.37.1",
"1.7.38",
"1.7.39",
"1.7.39.1",
"1.7.39.2",
"1.7.39.3",
"1.7.39.4",
"1.7.4",
"1.7.40",
"1.7.41",
"1.7.41.1",
"1.7.41.2",
"1.7.42",
"1.7.42.1",
"1.7.42.2",
"1.7.42.3",
"1.7.43",
"1.7.44",
"1.7.45",
"1.7.46",
"1.7.47",
"1.7.48",
"1.7.49",
"1.7.49.1",
"1.7.49.2",
"1.7.49.3",
"1.7.49.4",
"1.7.49.5",
"1.7.5",
"1.7.51",
"1.7.52",
"1.7.53",
"1.7.53.1",
"1.7.53.2",
"1.7.53.3",
"1.7.6",
"1.7.7",
"1.7.8",
"1.7.9",
"1.8.0-beta.1",
"1.8.0-beta.10",
"1.8.0-beta.11",
"1.8.0-beta.12",
"1.8.0-beta.13",
"1.8.0-beta.14",
"1.8.0-beta.15",
"1.8.0-beta.16",
"1.8.0-beta.17",
"1.8.0-beta.18",
"1.8.0-beta.19",
"1.8.0-beta.2",
"1.8.0-beta.20",
"1.8.0-beta.21",
"1.8.0-beta.22",
"1.8.0-beta.23",
"1.8.0-beta.24",
"1.8.0-beta.25",
"1.8.0-beta.26",
"1.8.0-beta.27",
"1.8.0-beta.28",
"1.8.0-beta.29",
"1.8.0-beta.3",
"1.8.0-beta.4",
"1.8.0-beta.5",
"1.8.0-beta.6",
"1.8.0-beta.7",
"1.8.0-beta.8",
"1.8.0-beta.9",
"2.0.0",
"2.0.0-beta.1",
"2.0.0-beta.2",
"2.0.0-beta.3",
"2.0.0-beta.4",
"2.0.0-rc.1",
"2.0.0-rc.10",
"2.0.0-rc.2",
"2.0.0-rc.3",
"2.0.0-rc.4",
"2.0.0-rc.5",
"2.0.0-rc.6",
"2.0.0-rc.7",
"2.0.0-rc.8",
"2.0.0-rc.9",
"2.0.1",
"2.0.2",
"2.0.3"
]
}