CVE-2026-74907: Directory Traversal in Grav CMS Pre-Boot Static Asset Server

Vulnerability ID: CVE-2026-74907
CVSS Score: 5.9
Published: 2026-09-17

An unauthenticated directory traversal vulnerability exists in Grav CMS prior to version 2.0.15. Due to an insecure string-based containment check (str_starts_with) in the pre-boot static asset server, attackers can read files in sibling directories sharing a prefix with the configured asset path when plugin-asset-map.php is enabled.

TL;DR

An insecure string containment check in Grav's pre-boot asset server allows unauthenticated remote attackers to read files in sibling directories via path traversal.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-22
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 5.9 (Medium)
• EPSS Score: 0.00333 (Percentile: 26.56%)
• Impact: Confidentiality (High)
• Exploit Status: Proof of Concept / Conceptual
• CISA KEV Status: Not Listed

Affected Systems

• Grav CMS
• Grav: < 2.0.15 (Fixed in: 2.0.15)

Code Analysis

Commit: d5f89d9

Fix path traversal issue in pre-boot asset server

Mitigation Strategies

• Upgrade the Grav core installation to version 2.0.15 or newer.
• Manually apply the directory boundary enforcement patch to index.php.
• Disable the static asset mapping feature by removing the plugin-asset-map.php configuration file.

Remediation Steps:

1. Download Grav version 2.0.15 or verify updates via the Grav administration panel.
2. If manual patching is chosen, open index.php and update the str_starts_with statement to append a directory separator.
3. Navigate to the user/config/ directory and verify if plugin-asset-map.php is present; delete it if asset mapping is unused.

References

• GitHub Security Advisory GHSA-4v9q-p283-qc2m
• NVD Vulnerability Details for CVE-2026-74907
• VulnCheck Security Advisory
• Official Commit Patch

Read the full report for CVE-2026-74907 on our website for more details including interactive diagrams and full exploit analysis.