Advisory · CVE-2026-100669
Grav web.config case trick exposes secrets on IIS
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In web.config for IIS, every deny rule sets ignoreCase='false', overriding the IIS default; on case-insensitive NTFS, an unauthenticated remote attacker can vary the case of a folder or extension (e.g. requesting /user/CONFIG/system.YAML) so no deny rule matches and the static file handler returns the file, disclosing configuration secrets or account password hashes. Fixed in 2.0.25; operators must re-copy the corrected sample files after upgrading because the installer heal does not touch web.config or lighttpd.conf.
- Vendor
- Grav
- Product
- Grav
- Identifier / CWE
- CVE-2026-100669
CWE-178 - Action timing
- Immediate
Explain it like I’m five
The guard has a list of rooms visitors may not enter, but checks the names letter-for-letter. A visitor writes a forbidden room's name in ALL CAPS, the guard finds no match, and opens the door.
- 01Case-varied request
An unauthenticated attacker requests a protected path with altered case, such as /user/CONFIG/system.YAML.
- 02Deny rules miss
Every deny rule in web.config sets ignoreCase='false', so no rule matches the altered case.
- 03Static handler serves
On case-insensitive NTFS the file resolves and the static file handler returns it.
- 04Secrets disclosed
Configuration secrets or account password hashes are exposed to the unauthenticated attacker.
What happened
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively (CVE-2026-100669, CVSS 8.7). In web.config for IIS, every deny rule sets ignoreCase=‘false’, overriding the IIS default; on case-insensitive NTFS, an unauthenticated remote attacker can vary the case of a folder or extension (for example requesting /user/CONFIG/system.YAML) so that no deny rule matches and the static file handler returns the file, disclosing configuration secrets or account password hashes. Lighttpd’s lighttpd.conf sample is affected by the same class of flaw. Fixed in Grav 2.0.25. Operators must re-copy the corrected sample files after upgrading, because the installer heal does not touch web.config or lighttpd.conf.
What to do
- Upgrade Grav to 2.0.25 or later.
- Re-copy the corrected web.config and lighttpd.conf sample files into place; the upgrade alone does not fix them.
- Rotate any secrets that lived in configuration files or account YAML (password hashes, API keys).
- Check access logs for requests with case-varied paths under /user/, /cache/, /backup/, and similar protected folders.
Management note
The patch is necessary but not sufficient here: if you upgrade and skip the config re-copy, you are still vulnerable. Put the sample-file replacement on the runbook checklist, not in a footnote.