CVE-2026-126745

This module enables you to display users by a configurable "real name" pattern built from tokens, instead of by their username. The module does not sufficiently sanitize user input used in name patterns. A user can place Twig syntax in their own profile data and have it evaluated when their name ...

DRUPAL-CONTRIB-2026-336

This module enables you to display users by a configurable "real name" pattern built from tokens, instead of by their username. The module does not sufficiently sanitize user input used in name patterns. A user can place Twig syntax in their own profile data and have it evaluated when their name ...

PT-2026-145660

This module enables you to display users by a configurable "real name" pattern built from tokens, instead of by their username. The module does not sufficiently sanitize user input used in name patterns. A user can place Twig syntax in their own profile data and have it evaluated when their name ...

Arbitrary File Read / Account Takeover

getgrav/grav is vulnerable to to Account Takeover. The vulnerability is due to a lack of proper access controls and input validation mechanisms, allowing low privilege users with page edit privilege to exploit Twig Syntax to read sensitive server files, compromising user accounts and potentially...

Grav Vulnerable to Arbitrary File Read to Account Takeover

Summary A low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise...

GHSA-F8V5-JMFH-PR69 Grav Vulnerable to Arbitrary File Read to Account Takeover

Summary A low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise...

CVE-2024-34082 Grav Arbitrary File Read to Account Takeover

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password res...

CVE-2024-34082 Grav Arbitrary File Read to Account Takeover

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password res...

CVE-2024-34082

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password res...

CVE-2024-34082 Grav Arbitrary File Read to Account Takeover

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password res...

PT-2024-25693

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.46 Description A low privilege user account with page edit privilege can read any server files using Twig Syntax, including Grav user account files - /grav/user/accounts/.yaml, which stores hashed user password, 2FA...

CVE-2024-34082: Improper Privilege Management

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password res...