Unauthenticated Path Traversal in Grav via Missing Directory-Boundary Check
A critical vulnerability (CVE-2026-74907, CVSS 8.2) exists in Grav, a popular PHP-based content management system. The flaw, caused by a missing directory-boundary check in the `plugin-asset-map.php` static asset server, allows unauthenticated attackers to perform path traversal attacks. This can lead to unauthorized file disclosure, potentially resulting in RCE, data exfiltration, or admin-equivalent control. The vulnerability affects Grav versions 2.0.15 and the devel branch, but only when a specific plugin configuration file (`user/config/plugin-asset-map.php`) is present and in use.