Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Verified against: getgrav/grav devel branch, GRAV_VERSION = "2.0.15", file `index.php

Title

Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server (index.php)

Product / Affected Versions

• Product: getgrav/grav
• File: index.php (top-level front controller, runs before Grav itself boots)
• Confirmed present in: devel branch, 2.0.15
• Precondition: requires user/config/plugin-asset-map.php to exist and contain at least one route-prefix mapping ,this is an opt-in mechanism (per the code comment: "Fast static asset serving for plugins that bundle SPA apps"). No core mechanism generates this file automatically; it's created by a plugin that opts into this fast-path. Not reachable on a stock Grav install with no such plugin. Where reachable, it requires zero authentication.

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') , specific mechanism: a path-prefix containment check performed with plain string comparison (str_starts_with) instead of a directory-boundary-aware comparison, allowing escape into any sibling path whose name happens to extend the base directory's name as a string.

Description

index.php implements a fast-path static file server that runs before Grav's own routing/security stack, gated on the presence of an asset-map file:

$assetMapFile = __DIR__ . '/user/config/plugin-asset-map.php';
if (is_file($assetMapFile)) {
    $assetMap = require $assetMapFile;
    foreach ($assetMap as $routePrefix => $diskPath) {
        if (str_starts_with($path, $routePrefix)) {
            $relPath = substr($path, strlen($routePrefix));
            $filePath = __DIR__ . '/' . ltrim($diskPath, '/') . $relPath;
            $realFile = realpath($filePath);
            $realBase = realpath(__DIR__ . '/' . ltrim($diskPath, '/'));
            if ($realFile && $realBase && str_starts_with($realFile, $realBase) && is_file($realFile)) {
                // ... serves $realFile directly, with Content-Type inferred from extension
                readfile($realFile);
                exit;
            }
        }
    }
}

realpath() correctly resolves .. sequences, so a naive ../../etc/passwd-style traversal that leaves the filesystem entirely is blocked (it wouldn't share the $realBase string prefix). it's a plain string-prefix test, not "is inside the directory." Any resolved path whose string representation merely the same characters as passes, including sibling directories that extend the base directory's name ( → , , , , etc.) a very common real-world directory-naming pattern (backup dirs, versioned dirs, disabled/legacy dirs sitting alongside the active one).