cve-2026-100671-poc

CVE-2026-100671 — Divulgación de cookie de sesión mediante Twig en Grav Verificador mínimo, solo local, para la toma de control de sesión mediante Twig de contenido/caché de páginas de Grav, corregida en Grav 2.0.25. Avisos: CVE-2026-100671 GHSA-pp89-h475-7gj6 Grav 2.0.25 release Alcance exploit....

Exploit for CVE-2026-100671

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal...

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists getcookie, which returns a...