What is GHSA-2rhw-8953-48q3?

GHSA-2rhw-8953-48q3 is a security advisory published by GitHub Security Advisories with High severity. Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Why does GHSA-2rhw-8953-48q3 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-2rhw-8953-48q3?

GHSA-2rhw-8953-48q3 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-2rhw-8953-48q3?

GHSA-2rhw-8953-48q3 affects 1 product, including: composer/getgrav/grav:\u003c 2.0.15.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 17, 2026

GHSA-2rhw-8953-48q3HighCVSS 5.9Disclosed before NVD

Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

September 17, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references.

Original Description

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.

🎯 Affected products1

composer/getgrav/grav:< 2.0.15

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (4)