How severe is CVE-2026-62673?

CVE-2026-62673 has a CVSS 4.0 base score of 8.2, rated high severity.

Is CVE-2026-62673 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-62673?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-62673 published?

CVE-2026-62673 was published on 2026-08-19 and last updated on 2026-08-21.

CVE-2026-62673

CVE-2026-62673 is a high-severity vulnerability with a CVSS 4.0 base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-178.

Key facts

Severity: High (CVSS 4.0 base score 8.2)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-178
Published: 2026-08-19
Last modified: 2026-08-21

Description

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.

Frequently asked questions

What is CVE-2026-62673?: Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to bypass the rules and retrieve files under user/accounts or user/config, including password hashes and security configuration. This issue is fixed in version 2.0.4.
How severe is CVE-2026-62673?: CVE-2026-62673 has a CVSS 4.0 base score of 8.2, rated high severity.
Is CVE-2026-62673 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-62673?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-62673 published?: CVE-2026-62673 was published on 2026-08-19 and last updated on 2026-08-21.

References

Other CWE-178 vulnerabilities

CVE-2026-54763 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth,…
CVE-2026-40453 — Critical (CVSS 9.9): The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such…
CVE-2026-47323 — Critical (CVSS 9.8): Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative…
CVE-2024-5699 — Critical (CVSS 9.8): In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by…
CVE-2023-3545 — Critical (CVSS 9.8): Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache…
CVE-2022-29604 — Critical (CVSS 9.8): An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which…

Browse all CWE-178 vulnerabilities →