What is CVE-2026-74907?
Grav versions before 2.0.15 contain a path traversal vulnerability in the static asset server within index.php. Due to the use of string prefix matching instead of directory-boundary validation, unauthenticated attackers can access files in sibling directories. Immediate update to the latest version is recommended.
Azərbaycanca: Grav 2.0.15-dən əvvəlki versiyalarda 'index.php' faylındakı statik aktiv serverdə path traversal zəifliyi aşkarlanıb. Bu, autentifikasiya olunmamış hücumçulara sənəd adının 'string prefix matching' ilə yoxlanılması səbəbindən əsas qovluqdan kənar fayllara giriş imkanı verir. Grav tətbiqini dərhal ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Is authentication required to exploit CVE-2026-74907?
No, this path traversal vulnerability allows unauthenticated attackers to access files outside the Grav root directory.
What is the root cause of CVE-2026-74907?
The vulnerability stems from the use of string prefix matching instead of directory-boundary validation in the static asset server within index.php.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.