CVE-2026-112781

The Grav CMS (versions 2.0.0 before 2.2.2 ) is vulnerable to an information disclosure flaw. The issue stems from the ability of users with page-edit permissions to add config-*@ directives to page frontmatter forms. This allows them to bypass the Twig sandbox config_denied_paths redaction, poten...