THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-4v9q-p283-qc2m (high) — Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

[GHSA] GHSA-4v9q-p283-qc2m (high) — Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

medgithub_advisoriesPublished 2026-09-17

GHSA-4v9q-p283-qc2m Severity: high CVE: CVE-2026-74907

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

**Verified against:** `getgrav/grav` devel branch, `GRAV_VERSION = "2.0.15"`, file `index.php

## Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asse

Indicators of compromise

CVE-2026-74907cve

Original source: https://github.com/advisories/GHSA-4v9q-p283-qc2m