{"id":"GHSA-2rhw-8953-48q3","title":"Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)","summary":"Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)","severity":"high","cvss":5.9,"cwe":["CWE-22"],"vendor":"getgrav","product":"getgrav/grav","ecosystem":"composer","affected":["getgrav/grav < 2.0.15"],"published":"2026-08-18","updated":"2026-09-17","sourceUpdated":"2026-09-17T20:59:49Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2rhw-8953-48q3","references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74907"},{"url":"https://www.vulncheck.com/advisories/grav-before-path-traversal-via-plugin-asset-map-php"},{"url":"https://github.com/advisories/GHSA-2rhw-8953-48q3"}],"tags":["ghsa","composer"],"ingestedAt":"2026-09-17T21:29:16.993Z","slug":"GHSA-2rhw-8953-48q3","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.\n\n## Affected packages\n\n- `getgrav/grav < 2.0.15`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}