The vulnerability arises because Grav’s default .htaccess lacks the [NC] flag, making file extension checks case-sensitive. An unauthenticated attacker can request files with uppercase or mixed‑case extensions (e.g., .YAML, .PHP) on case‑insensitive filesystems to bypass the restrictions and retrieve sensitive files that may contain API keys or credentials.

The affected product is Grav by getgrav. All releases before version 2.0.4 are affected; any deployment using the default .htaccess configuration on a case‑insensitive filesystem (Windows, macOS, Docker volumes) is vulnerable.

The CVSS score of 8.7 classifies this as high severity, and the EPSS score of less than 1% indicates a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request that uses a non‑standard file extension case to circumvent server‑side access controls and read unauthorized configuration files.