CVE-2026-100669 – Sensitive File Disclosure (IIS Config Bypass) – Grav CMS before 2.0.25

Summary

CVE-2026-100669 is a sensitive file disclosure vulnerability in Grav CMS versions before 2.0.25, caused by case-sensitive access-control rules in the sample IIS web server configuration shipped with the product. On IIS deployments running over case-insensitive NTFS, an unauthenticated remote attacker can bypass the deny rules by varying the case of a folder name or file extension, potentially exposing configuration files and account password hashes. The flaw carries a CVSS v3.1 base score of 7.5 (High) / CVSS v4.0 score of 8.7 (High).

Technical details

• Root cause: The bundled webserver-configs/web.config for IIS defines deny rules for sensitive paths (user/config, user/accounts, user/data, error redirects, user/pages, system, vendor, and ignored folders) as URL Rewrite <match> elements with ignoreCase="false" explicitly set, overriding IIS’s default case-insensitive matching behavior. Because these are rewrite rules rather than <requestFiltering> elements, there is no case-insensitive fallback protection.
• Trigger conditions: The target must run on IIS with the sample web.config deployed, backed by a case-insensitive filesystem (standard NTFS). A request such as GET /user/CONFIG/system.YAML varies the case of the path so the deny rule fails to match, while the underlying case-insensitive filesystem still resolves the file.
• Attack vector: Network-based, unauthenticated, no user interaction required. The attacker simply issues a crafted HTTP GET request with altered path/extension casing.
• Impact: Disclosure of sensitive data such as configuration secrets and account password hashes. Whether a specific file is actually returned depends on IIS MIME type registration — .json is served by default, whereas .yaml/.yml return HTTP 404.3 unless a YAML MIME mapping has been added.
• A related, lower-risk gap exists in the bundled webserver-configs/lighttpd.conf, where rules for user/(config|env), directories, script extensions, root files, and dotfiles lack a case-insensitive modifier; this is considered lower risk because lighttpd typically runs on case-sensitive filesystems.
• Deployments served by Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected.

Affected software

• Grav CMS: all versions before 2.0.25 (getgrav/grav, version range 0 up to but excluding 2.0.25), when deployed on IIS with the bundled web.config sample configuration.

Severity

• CVSS v3.1 Base Score: 7.5 (High) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS v4.0 Base Score: 8.7 (High) — Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

• Immediate: Upgrade Grav to version 2.0.25 or later. Note that the vendor’s .htaccess installer "heal" process does not automatically update web.config or lighttpd.conf — operators must manually re-copy the corrected sample configuration files after upgrading.
• If patching is delayed / no patch applied yet:
  • For IIS deployments, manually edit web.config to remove ignoreCase="false" from deny rules, or add equivalent <requestFiltering> deny rules that are enforced case-insensitively.
  • For lighttpd deployments, add case-insensitive matching (e.g., an (?i) modifier) to the relevant deny rules in lighttpd.conf.
  • Restrict MIME type registrations on IIS to avoid inadvertently serving sensitive extensions (e.g., avoid adding YAML MIME mappings unless required).
  • Consider migrating sensitive deployments to Apache, nginx, Caddy, or the PHP built-in server, which are not affected by this issue.

References

• CVE-2026-100669 at NVD
• GitHub Security Advisory (GHSA-pg8v-xw58-frq8)
• VulnCheck Advisory: Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass