CVE-2026-112781

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

EUVD-2026-104587

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

CVE-2026-112781: Exposure of Sensitive Information to an Unauthorized Actor

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose...

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

GHSA-XJW5-Q542-3VMR Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...

GHSA-P597-CRQC-M349 Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...

Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block acce...

GHSA-CRRC-VPP2-F5X7 Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block acce...

Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p597-crqc-m349. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowi...

GHSA-MW85-CJH9-8HP7 Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p597-crqc-m349. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowi...

CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-72698: Exposure of Sensitive Information to an Unauthorized Actor

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...