CVE-2026-114657

Grav versions 2.0.0 before 2.2.5 are vulnerable to an information disclosure flaw. The issue occurs because authors can print the request Uri object —which contains the PHP_AUTH_USER and PHP_AUTH_PW environment variables—within Twig page content. An attacker or malicious page author can embed thi...