Grav is a file‑based web platform. Earlier releases omitted the Apache [NC] (no‑case) flag from the .htaccess rules that protect sensitive directories such as user/accounts and user/config. This omission causes the pattern matching to be case‑sensitive, allowing an unauthenticated requester to use uppercase variants of directories or file extensions to bypass the access controls and download files that contain password hashes or configuration data. The likely attack vector is a simple HTTP request to a public endpoint, and based on the description it is inferred that the underlying file system is case‑insensitive, typical of Windows or macOS default volumes.

The vulnerability affects the Grav open‑source web platform distributed by getgrav. All releases prior to version 2.0.4 are vulnerable, including deployments that store the site on a case‑insensitive filesystem such as Windows or macOS default volumes, and potentially other environments that employ case‑insensitive file storage. The impacted directories are user/accounts and user/config, where sensitive information may reside.

The CVSS base score of 8.2 classifies this issue as High severity, indicating substantial impact on confidentiality. The EPSS score of <1% reflects a very low probability of exploitation. Because the flaw can be triggered by a basic HTTP request to a public, unauthenticated endpoint, an attacker can easily exercise it on affected hosts. The vulnerability is not listed in the CISA KEV catalog and no public exploits are currently known; however it is listed as Remote Access, unauthenticated, therefore it can be attempted by anyone over the Internet.