Grav CMS versions prior to 2.0.15 suffer from a path traversal flaw in the static asset server within index.php. The server mistakenly uses string prefix matching instead of strict directory-boundary checks, allowing an attacker to craft requests that read files from sibling directories. If exploited, the attacker can recover sensitive or private files located beside the declared asset path, leading to confidentiality compromise and potential further exploitation.

All installations of Grav (Getgrav) running versions earlier than 2.0.15 are affected. The flaw resides in the plugin asset map component of Grav CMS.

The vulnerability carries a CVSS score of 8.2, classifying it as high severity. Although no EPSS score is available, the public disclosure and lack of mitigation suggest that exploitation is feasible. Because the flaw can be triggered through standard HTTP requests, unauthenticated attackers can initiate the exploit remotely, making it a significant threat to systems that expose the asset serving endpoint to the internet.