{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.14"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-74907"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:43:16Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**Verified against:** `getgrav/grav` devel branch, `GRAV_VERSION = \"2.0.15\"`, file `index.php\n\n## Title\nUnauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)\n\n## Product / Affected Versions\n- Product: `getgrav/grav`\n- File: `index.php` (top-level front controller, runs before Grav itself boots)\n- Confirmed present in: devel branch, 2.0.15\n- **Precondition:** requires `user/config/plugin-asset-map.php` to exist and contain at least one route-prefix mapping ,this is an opt-in mechanism (per the code comment: \"Fast static asset serving for plugins that bundle SPA apps\"). No core mechanism generates this file automatically; it\u0027s created by a plugin that opts into this fast-path. **Not reachable on a stock Grav install with no such plugin.** Where reachable, it requires zero authentication.\n\n## CWE\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) , specific mechanism: a path-prefix containment check performed with plain string comparison (`str_starts_with`) instead of a directory-boundary-aware comparison, allowing escape into any sibling path whose name happens to extend the base directory\u0027s name as a string.\n\n## Description\n\n`index.php` implements a fast-path static file server that runs *before* Grav\u0027s own routing/security stack, gated on the presence of an asset-map file:\n\n```php\n$assetMapFile = __DIR__ . \u0027/user/config/plugin-asset-map.php\u0027;\nif (is_file($assetMapFile)) {\n    $assetMap = require $assetMapFile;\n    foreach ($assetMap as $routePrefix =\u003e $diskPath) {\n        if (str_starts_with($path, $routePrefix)) {\n            $relPath = substr($path, strlen($routePrefix));\n            $filePath = __DIR__ . \u0027/\u0027 . ltrim($diskPath, \u0027/\u0027) . $relPath;\n            $realFile = realpath($filePath);\n            $realBase = realpath(__DIR__ . \u0027/\u0027 . ltrim($diskPath, \u0027/\u0027));\n            if ($realFile \u0026\u0026 $realBase \u0026\u0026 str_starts_with($realFile, $realBase) \u0026\u0026 is_file($realFile)) {\n                // ... serves $realFile directly, with Content-Type inferred from extension\n                readfile($realFile);\n                exit;\n            }\n        }\n    }\n}\n```\n\n`realpath()` correctly resolves `..` sequences, so a naive `../../etc/passwd`-style traversal that leaves the filesystem entirely is blocked (it wouldn\u0027t share the `$realBase` string prefix). **But the containment check itself, `str_starts_with($realFile, $realBase)`, has no directory-boundary awareness** it\u0027s a plain string-prefix test, not \"is `$realFile` inside the `$realBase` directory.\" Any resolved path whose string representation merely *begins with* the same characters as `$realBase` passes, including sibling directories that extend the base directory\u0027s name (`assets` \u2192 `assets-secret`, `assets.bak`, `assets_old`, `assets2`, etc.) a very common real-world directory-naming pattern (backup dirs, versioned dirs, disabled/legacy dirs sitting alongside the active one).\n\n## Live Proof of Concept\n\n**Setup:** the exact code block above, extracted verbatim from `index.php`, executed with PHP 8.3.6 against a realistic directory layout (a plugin\u0027s active `assets/` dir sitting next to an unrelated `assets-secret/` dir containing a fake secret):\n\n```\nuser/plugins/myplugin/assets/app.js            \u003c- intended, public\nuser/plugins/myplugin/assets-secret/config.php \u003c- NOT intended to be served\nuser/config/plugin-asset-map.php:\n    return [\u0027/myplugin-assets\u0027 =\u003e \u0027user/plugins/myplugin/assets\u0027];\n```\n\n**Legitimate request** (`/myplugin-assets/app.js`):\n```\nrealFile: \u0027/home/claude/grav-poc/user/plugins/myplugin/assets/app.js\u0027\nrealBase: \u0027/home/claude/grav-poc/user/plugins/myplugin/assets\u0027\n\u003e\u003e\u003e WOULD SERVE FILE \u003c\u003c\u003c\n\u003e\u003e\u003e Content: public asset content\n```\n\n**Traversal request** (`/myplugin-assets/../assets-secret/config.php`):\n```\nrealFile: \u0027/home/claude/grav-poc/user/plugins/myplugin/assets-secret/config.php\u0027\nrealBase: \u0027/home/claude/grav-poc/user/plugins/myplugin/assets\u0027\n\u003e\u003e\u003e WOULD SERVE FILE \u003c\u003c\u003c\n\u003e\u003e\u003e Content: SECRET_API_KEY=sk_live_totally_secret_12345\n```\n\n`str_starts_with(\u0027.../assets-secret/config.php\u0027, \u0027.../assets\u0027)` evaluates `true` because `assets-secret` literally begins with the characters `assets` there is no separator-boundary check (e.g. requiring `$realBase . \u0027/\u0027` as the actual prefix) to prevent this.\n\n## Trust-boundary framing (per Grav\u0027s own SECURITY.md)\nThis code path requires **no Grav account** , it runs before Grav even initializes, directly off the raw request path. Per Grav\u0027s own stated criteria: *\"An unauthenticated attacker can achieve RCE, exfiltrate site data, or gain admin-equivalent control. No Grav account required\"* \u2192 this matches the **CRITICAL** bar exactly, for any deployment where the `plugin-asset-map.php` mechanism is in active use.\n\n## Suggested Fix\nAppend a trailing directory separator before the prefix comparison, or use a proper containment check:\n```php\nif ($realFile \u0026\u0026 $realBase \u0026\u0026 (\n    $realFile === $realBase ||\n    str_starts_with($realFile, $realBase . DIRECTORY_SEPARATOR)\n) \u0026\u0026 is_file($realFile)) {\n```\nThis is the standard fix for this exact bug class\n, ensuring the matched prefix ends exactly at a directory boundary, not partway through a longer sibling name.",
  "id": "GHSA-4v9q-p283-qc2m",
  "modified": "2026-09-17T20:43:16Z",
  "published": "2026-09-17T20:43:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74907"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-before-path-traversal-via-plugin-asset-map-php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)"
}