https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:04:54 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-74907 <p>Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.</p> <p>Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-74907 https://vulnerability.circl.lu/vuln/ghsa-2rhw-8953-48q3 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references.</p> <p>### Original Description Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references.</p> <p>### Original Description Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.</p> https://vulnerability.circl.lu/vuln/ghsa-2rhw-8953-48q3