CVE-2026-114657

Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHPAUTHUSER and PHPAUTHPW, inside an inline style background image t...