https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 14:47:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354895 EUVD-2026-354895 https://cve.radiocsirt.org/vuln/euvd-2026-354895 https://cve.radiocsirt.org/vuln/fkie_cve-2026-74907 <p>Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.</p> <p>Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-74907 https://cve.radiocsirt.org/vuln/ghsa-4v9q-p283-qc2m <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>**Verified against:** `getgrav/grav` devel branch, `GRAV_VERSION = &#34;2.0.15&#34;`, file `index.php</p> <p>## Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)</p> <p>## Product / Affected Versions - Product: `getgrav/grav` - File: `index.php` (top-level front controller, runs before Grav itself boots) - Confirmed present in: devel branch, 2.0.15 - **Precondition:** requires `user/config/plugin-asset-map.php` to exist and contain at least one route-prefix mapping ,this is an opt-in mechanism (per the code comment: &#34;Fast static asset serving for plugins that bundle SPA apps&#34;). No core mechanism generates this file automatically; it&#39;s created by a plugin that opts into this fast-path. **Not reachable on a stock Grav install with no such plugin.** Where reachable, it requires zero authentication.</p> <p>## CWE CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) , specific mechanism: a path-prefix containment check performed with plain string comparison (`str_starts_with`) instead of a directory-boundary-aware comparison, allowing escape into any sibling path whose name happens to extend the base directory&#39;s name as a string.</p> <p>## Description</p> <p>`index.php` implements a fast-path static file server that runs *before* Grav&#39;s own routing/security stack, gated on the presence of an asset-map file:</p> <p>```php $assetMapFile = __DIR__ . &#39;/user/config/plugin-asset-map.php&#39;; if (is_file($assetMapFil…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>**Verified against:** `getgrav/grav` devel branch, `GRAV_VERSION = &#34;2.0.15&#34;`, file `index.php</p> <p>## Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)</p> <p>## Product / Affected Versions - Product: `getgrav/grav` - File: `index.php` (top-level front controller, runs before Grav itself boots) - Confirmed present in: devel branch, 2.0.15 - **Precondition:** requires `user/config/plugin-asset-map.php` to exist and contain at least one route-prefix mapping ,this is an opt-in mechanism (per the code comment: &#34;Fast static asset serving for plugins that bundle SPA apps&#34;). No core mechanism generates this file automatically; it&#39;s created by a plugin that opts into this fast-path. **Not reachable on a stock Grav install with no such plugin.** Where reachable, it requires zero authentication.</p> <p>## CWE CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) , specific mechanism: a path-prefix containment check performed with plain string comparison (`str_starts_with`) instead of a directory-boundary-aware comparison, allowing escape into any sibling path whose name happens to extend the base directory&#39;s name as a string.</p> <p>## Description</p> <p>`index.php` implements a fast-path static file server that runs *before* Grav&#39;s own routing/security stack, gated on the presence of an asset-map file:</p> <p>```php $assetMapFile = __DIR__ . &#39;/user/config/plugin-asset-map.php&#39;; if (is_file($assetMapFil…</p> https://cve.radiocsirt.org/vuln/ghsa-4v9q-p283-qc2m