{"metadata": {"vulnerability": "CVE-2026-74907", "count": 18, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-74907", "field": "containers.cna.datePublic"}, {"timestamp": "2026-08-17T10:48:45.738Z", "date_only": false, "value": "2026-08-17T10:48:45.738Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-74907", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-18T11:19:38.302Z", "date_only": false, "value": "2026-08-18T11:19:38.302Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-74907", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-18T12:19:31Z", "date_only": false, "value": "2026-08-18T12:19:31Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2RHW-8953-48Q3", "record": "GHSA-2RHW-8953-48Q3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-18T12:19:31.047Z", "date_only": false, "value": "2026-08-18T12:19:31.047", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74907", "record": "FKIE_CVE-2026-74907", "field": "published"}, {"timestamp": "2026-08-18T12:31:21Z", "date_only": false, "value": "2026-08-18T12:31:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2RHW-8953-48Q3", "record": "GHSA-2RHW-8953-48Q3", "field": "published"}, {"timestamp": "2026-08-18T12:51:20.275Z", "date_only": false, "value": "2026-08-18T12:51:20.275069Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-74907", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-18T12:51:20.275Z", "date_only": false, "value": "2026-08-18T12:51:20.275069Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74907", "record": "FKIE_CVE-2026-74907", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-18T13:36:23.049Z", "date_only": false, "value": "2026-08-18T13:36:23.049Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-74907", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-17T20:42:56Z", "date_only": false, "value": "2026-09-17T20:42:56Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2RHW-8953-48Q3", "record": "GHSA-2RHW-8953-48Q3", "field": "modified"}, {"timestamp": "2026-09-17T20:42:56Z", "date_only": false, "value": "2026-09-17T20:42:56Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-2RHW-8953-48Q3", "record": "GHSA-2RHW-8953-48Q3", "field": "withdrawn"}, {"timestamp": "2026-09-17T20:43:16Z", "date_only": false, "value": "2026-09-17T20:43:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4V9Q-P283-QC2M", "record": "GHSA-4V9Q-P283-QC2M", "field": "published"}, {"timestamp": "2026-09-17T20:43:16Z", "date_only": false, "value": "2026-09-17T20:43:16Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4V9Q-P283-QC2M", "record": "GHSA-4V9Q-P283-QC2M", "field": "modified"}, {"timestamp": "2026-09-17T22:35:06.211Z", "date_only": false, "value": "2026-09-17T22:35:06.211179Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-4v9q-p283-qc2m", "record": "CVE-2026-74907", "field": "creation_timestamp", "uuid": "aab4e1d1-ae9c-4580-9ad2-b117c47d6606", "url": "https://github.com/advisories/GHSA-4v9q-p283-qc2m"}, {"timestamp": "2026-09-18T02:31:49.781Z", "date_only": false, "value": "2026-09-18T02:31:49.781142Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/c2299acc28e550e2d0a5db2c44f59d94", "record": "CVE-2026-74907", "field": "creation_timestamp", "uuid": "0c881641-cc5a-4ab2-9b0a-8f725410ce69", "content": "# CVE-2026-74907: CVE-2026-74907: Directory Traversal in Grav CMS Pre-Boot Static Asset Server\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-74907\n\n## Summary\nAn unauthenticated directory traversal vulnerability exists in Grav CMS prior to version 2.0.15. Due to an insecure string-based containment check (str_starts_with) in the pre-boot static asset server, attackers can read files in sibling directories sharing a prefix with the configured asset path when plugin-asset-map.php is enabled.\n\n## TL;DR\nAn insecure string containment check in Grav's pre-boot asset server allows unauthenticated remote attackers to read files in sibling directories via path traversal.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00333 (Percentile: 26.56%)\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof of Concept / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS\n- **Grav**: < 2.0.15 (Fixed in: `2.0.15`)\n\n## Mitigation\n\n- Upgrade the Grav core installation to version 2.0.15 or newer.\n- Manually apply the directory boundary enforcement patch to index.php.\n- Disable the static asset mapping feature by removing the plugin-asset-map.php configuration file.\n\n**Remediation Steps:**\n1. Download Grav version 2.0.15 or verify updates via the Grav administration panel.\n2. If manual patching is chosen, open index.php and update the str_starts_with statement to append a directory separator.\n3. Navigate to the user/config/ directory and verify if plugin-asset-map.php is present; delete it if asset mapping is unused.\n\n## References\n\n- [GitHub Security Advisory GHSA-4v9q-p283-qc2m](https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m)\n- [NVD Vulnerability Details for CVE-2026-74907](https://nvd.nist.gov/vuln/detail/CVE-2026-74907)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/grav-before-path-traversal-via-plugin-asset-map-php)\n- [Official Commit Patch](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd.patch)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-74907) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/c2299acc28e550e2d0a5db2c44f59d94"}, {"timestamp": "2026-10-08T15:24:54.514Z", "date_only": false, "value": "2026-10-08T15:24:54.514Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-74907", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-08T15:24:54.514Z", "date_only": false, "value": "2026-10-08T15:24:54.514Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-74907", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T16:17:40.480Z", "date_only": false, "value": "2026-10-08T16:17:40.480", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74907", "record": "FKIE_CVE-2026-74907", "field": "lastModified"}]}