CVE-2026-100669

Executive Summary

CVE-2026-100669 is a case-sensitivity access-control bypass in the sample web server configuration files distributed with the Grav content management system. The bundled IIS web.config and lighttpd.conf samples define deny rules that are matched case-sensitively, so on systems with case-insensitive file resolution (IIS over NTFS) an unauthenticated attacker can request protected files using alternate casing to evade those rules. Successful exploitation discloses sensitive data — such as configuration secrets or account password hashes — from directories Grav intends to block entirely. Grav deployments served by Apache, nginx, Caddy, or PHP's built-in server are not affected.

Technical Analysis

The vulnerability resides in the sample web server configurations shipped in the Grav repository under webserver-configs/. According to NVD, the IIS sample webserver-configs/web.config defines deny rules covering a known set of protected targets: user_sensitive_folders, user_accounts, user_data, user_error_redirect, user_pages, system, vendor, and ignore_folders. Each of these deny rules is implemented as a URL Rewrite <match> element configured with ignoreCase="false". IIS defaults URL Rewrite match evaluation to ignoreCase="true"; the sample explicitly overrides that default, disabling case-insensitive evaluation.

This is the crux of the defect. Because the protections are implemented as rewrite matches rather than <requestFiltering> elements, there is no case-insensitive fallback path in IIS. A request whose path differs only in letter case from the literal string in the deny rule fails to match the rule and is therefore not blocked. On IIS running atop case-insensitive NTFS, the static file handler subsequently resolves the differently-cased path to the same physical file on disk and returns it. The two behaviors combined — a case-sensitive ACL check in front of a case-insensitive filesystem — produce a complete access-control bypass.

The NVD description provides a concrete illustration: a request such as GET /user/CONFIG/system.YAML manipulates the case of both a directory component and a file extension so that no deny rule matches, yet NTFS resolves it to the intended protected resource. The class of weakness is classified as CWE-178 (Improper Handling of Case Sensitivity).

Whether a bypassed resource is actually returned depends on MIME registration. On a stock IIS installation, .json is served by default, whereas .yaml/.yml produce HTTP 404.3 unless a YAML MIME mapping has been added. This means the practical exploitability of any given file depends on the operator's MIME configuration; .json-based resources are directly retrievable, while YAML resources require a non-default MIME mapping.

The same class of gap is reported in the bundled webserver-configs/lighttpd.conf. Its rules for user/(config|env), directory, script-extension, root-file, and dotfile protections lack the (?i) case-insensitive modifier. NVD assesses this as lower risk because lighttpd typically runs on case-sensitive filesystems, where a differently-cased path simply will not resolve to the protected file.

Deployments served by Apache (.htaccess), nginx, Caddy, or the PHP built-in server are explicitly not affected. The issue is fixed in Grav 2.0.25. The NVD description text is truncated mid-sentence ("because the .htaccess instal…"), so the remediation note concerning .htaccess installations is incomplete in the supplied data; no further detail on that point is asserted here.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE; the attack chain below is inferred strictly from the vulnerability class and the specific technical detail present in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an Internet-exposed IIS-hosted Grav instance. Grav is recognizable by its typical URL structure and asset paths (e.g., /user/themes, /user/plugins). The attacker confirms the target runs IIS on Windows, since the bypass depends on case-insensitive NTFS resolution beneath a case-sensitive rewrite ACL.

2. Triggering the flaw class. The attacker crafts HTTP requests that reference the protected paths using non-canonical casing. Because the deny rules in webserver-configs/web.config are matched case-sensitively (ignoreCase="false") and are implemented as rewrite matches rather than request-filtering rules, a request such as GET /user/CONFIG/system.YAML (as given in the NVD description) fails to match any deny rule. There is no case-insensitive fallback to catch it.

3. Payload / execution method. The request is a plain, unauthenticated GET. No credentials, parameters, or injection are required — the "payload" is the altered case of the path and extension. IIS, operating over case-insensitive NTFS, resolves the differently-cased path to the underlying protected file. The file is returned only if its extension has a registered MIME type: .json is served by default, while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been configured.

4. Post-exploitation impact. Disclosed files can include configuration secrets or account password hashes residing in the protected directories (user_accounts, user_data, system, vendor, user_sensitive_folders, and the others enumerated in the deny rules). The attacker can then use exposed secrets for lateral access, credential cracking, or further compromise. There is no integrity or availability impact — the CVSS vector is confidentiality-only (C:H/I:N/A:N).

The lighttpd.conf variant is the same mechanism but lower risk: because lighttpd typically runs on case-sensitive filesystems, an attacker cannot rely on the operating system to resolve the altered-case path to the protected file. Successful exploitation there would require the filesystem itself to be case-insensitive.

Impact Assessment

Successful exploitation is a high-confidentiality breach with no integrity or availability effect. The CVSS v3.1 base score is 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N:

• AV:N (Network) — exploitable remotely over the network.
• AC:L (Low) — no special conditions beyond the affected configuration (IIS on case-insensitive NTFS; MIME registration for the target file type).
• PR:N (None) — no authentication required.
• UI:N (None) — no user interaction.
• S:U (Unchanged) — impact confined to the vulnerable component.
• C:H (High) — disclosure of secrets and password hashes.
• I:N / A:N — no integrity or availability impact.

Blast radius is limited to Grav deployments using the bundled IIS sample configuration on case-insensitive filesystems. Apache (.htaccess), nginx, Caddy, and PHP built-in server deployments are not affected. The effective blast radius per host further depends on MIME registration: .json resources are retrievable on a stock IIS, whereas .yaml/.yml resources require a non-default YAML MIME mapping.

Business impact centers on credential and secret exposure. Configuration secrets can unlock downstream systems; exposed password hashes enable offline cracking and credential-reuse attacks. The vulnerability is unauthenticated and trivially automatable, so any Internet-exposed, affected instance should be considered at risk. No EPSS score has been published by FIRST.org, and the CVE is not listed in CISA KEV — there is no evidence of active exploitation in the wild as of this writing.

Detection Guidance

Sigma Rule

title: Grav Case-Sensitivity Access Control Bypass Attempt (IIS)
id: 8f2c1a94-7d3b-4e6a-9b21-0c5f7a6e3d10
status: experimental
description: Detects HTTP requests to Grav protected paths using alternate casing to bypass case-sensitive deny rules (CVE-2026-100669).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100669
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: iis
detection:
  selection_paths:
    cs-uri-stem|re:
      - '/(?i)user/CONFIG/'
      - '/(?i)user/ACCOUNTS/'
      - '/(?i)user/DATA/'
      - '/(?i)SYSTEM/'
      - '/(?i)VENDOR/'
      - '/(?i)user/ERROR_REDIRECT/'
      - '/(?i)user/PAGES/'
  selection_upper:
    cs-uri-stem|contains:
      - '/USER/'
      - '/Config/'
  condition: selection_paths and selection_upper
falsepositives:
  - Legitimate case-preserving links (rare; Grav paths are lowercase by convention)
level: high

YARA Rule

rule CVE_2026_100669_Grav_IIS_CaseBypass_Config
{
    meta:
        description = "Detects Grav web.config sample with case-sensitive deny rules (ignoreCase=false) - CVE-2026-100669"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100669"
        date = "2026-01-01"
        severity = "high"

    strings:
        $rewrite = "<rewrite>" ascii nocase
        $match1  = "<match url=" ascii nocase
        $icfalse = "ignoreCase=\"false\"" ascii nocase
        $deny1   = "user_sensitive_folders" ascii nocase
        $deny2   = "user_accounts" ascii nocase
        $deny3   = "user_data" ascii nocase
        $deny4   = "user_error_redirect" ascii nocase
        $deny5   = "user_pages" ascii nocase
        $deny6   = "system" ascii nocase
        $deny7   = "vendor" ascii nocase
        $deny8   = "ignore_folders" ascii nocase

    condition:
        $rewrite and $match1 and $icfalse and 2 of ($deny*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100669 Grav IIS Case-Sensitivity Access Control Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(?i)\/user\/(config|accounts|data|error_redirect|pages)\/|(?i)\/(system|vendor)\//"; pcre:"/\/[A-Z]/"; reference:cve,2026-100669; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100669; classtype:attempted-recon; sid:2026100669; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where http.request.method == "GET" and
      http.request.uri : ("/user/config/" or "/user/accounts/" or "/user/data/" or
                          "/system/" or "/vendor/" or "/user/pages/") ]
  [ network where http.request.method == "GET" and
      http.request.uri : "*" and
      /* upper/mixed-case directory or extension variant */
      http.request.uri regex ".*/(USER|User|CONFIG|Config|SYSTEM|System|VENDOR|Vendor)/.*|.*\.(YAML|Yml|JSON|Json|YML)$" ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=iis_logs
| eval path=lower(cs_uri_stem)
| where match(path, "^/(user/(config|accounts|data|error_redirect|pages)|system|vendor|ignore)")
        AND cs_uri_stem != lower(cs_uri_stem)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(cs_uri_stem) as requested_paths by src_ip, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,accesslog,cve-2026-100669,">
  <rule id="100669" level="12">
    <if_sid>31100</if_sid>
    <url>\/user\/(config|accounts|data|error_redirect|pages)\/|\/system\/|\/vendor\/</url>
    <description>CVE-2026-100669: Possible Grav IIS case-sensitivity access control bypass - mixed/upper-case request to protected path</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_access_control,cve_2026_100669,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected-version metadata, or OSV package data was returned by tracked sources. NVD states the issue is fixed in Grav 2.0.25; this is the authoritative remediation target.

1. Immediate mitigations

   • If running the bundled IIS sample, edit webserver-configs/web.config so that every affected URL Rewrite <match> element uses ignoreCase="true" (i.e., remove the explicit ignoreCase="false" override and rely on the IIS default), or migrate the protection to <requestFiltering>/<hiddenSegments> elements that have no case-sensitive fallback gap.
   • For the lighttpd.conf sample, add the (?i) modifier to the user/(config|env), directory, script-extension, root-file, and dotfile rules.
   • Restrict or remove MIME mappings that would allow sensitive extensions to be served (notably the default .json serving on IIS, and any custom .yaml/.yml mappings). This reduces — but does not eliminate — the exploit surface.
   • Reduce exposure by placing the site behind an authenticating reverse proxy or WAF rule that normalizes request path casing before evaluation, and by ensuring protected directories are not web-served.
   • Verify whether the instance is actually affected: Apache (.htaccess), nginx, Caddy, and the PHP built-in server are not affected.

2. Patch / upgrade steps

   • Upgrade Grav to 2.0.25 or later. This is the fixing release per NVD. No alternate vendor patch source was identified in the tracked data.
   • After upgrading, re-deploy and re-verify the bundled web.config/lighttpd.conf samples rather than retaining stale copies.

3. Long-term hardening

   • Adopt a policy of case-insensitive, canonicalized path matching for all deny/allow rules in web server configuration.
   • Maintain an explicit allowlist of file types that may be served statically; never rely on default MIME registration to gate sensitive resources.
   • Rotate any secrets, API keys, and credential material that may have been exposed, and force password resets for affected accounts if password hashes could have been disclosed.
   • Monitor web logs persistently for mixed/upper-case requests to protected Grav paths, using the detection content above.

References

• NVD — CVE-2026-100669: https://nvd.nist.gov/vuln/detail/CVE-2026-100669
• MITRE CWE-178 — Improper Handling of Case Sensitivity: https://cwe.mitre.org/data/definitions/178.html
• Grav (getgrav.org) — official project and release repository for version 2.0.25.
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog — CVE-2026-100669 is not listed; no known exploited-vulnerability status.

No public PoC, Nuclei template, or exploit code was identified in the supplied data. There is no reported threat-actor campaign or confirmed exploit-in-the-wild evidence for CVE-2026-100669 at this time.