The vulnerability originates from how Grav ships sample web‑server configuration files. In IIS, deny rules are defined with ignoreCase="false" on rewrite matches, which overrides IIS's default ignore case matching. Because the rewrite engine is case sensitive, an attacker can change the case of a requested directory or file extension to avoid triggering the deny rule. The static file handler will then serve the requested file, exposing sensitive configuration information or password hashes to the attacker. The same issue exists in the bundled lighttpd configuration, lacking a case‑insensitive modifier, but the risk is lower because lighttpd typically runs on case‑sensitive file systems.

This flaw affects Grav installations running on IIS with a case‑insensitive NTFS file system, and the bundled lighttpd configuration files in any Grav distribution prior to version 2.0.25. The vulnerability is present in Grav 2.0.24 and earlier. Apache, nginx, Caddy, or the PHP built‑in server configurations are not affected, nor is the system if the operator has replaced the sample web.config or lighttpd.conf with the corrected versions. The affected vendor is Getgrav and the product is Grav.

The flaw has a CVSS score of 8.7 and is not currently listed in the CISA KEV catalog, but its exploitation probability is unknown due to the lack of measurable EPSS data. A remote, unauthenticated attacker can exploit the case‑variation bypass by sending a GET request with a case‑flipped path, such as /USER/CONFIG/system.YAML, on an IIS instance. If YAML MIME mapping is absent the request returns a 404.3, yet a JSON file will be served by default, so any JSON‑based configuration hidden in that directory becomes visible. On lighttpd the same principle applies, though the attacker would need a case‑sensitive file system. The risk is that exposed files may contain credentials or other secrets, thereby providing attackers with privileged information.