EUVD-2026-87765

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists getcookie, which returns a...

cve-2026-9558-poc

CVE-2026-9558 — MauticテーマテンプレートのサーバーサイドテンプレートインジェクションSSTIからフル管理者乗っ取りへ 目次 概要 影響を受けるバージョン 根本原因 分析 リポジトリ構成 必要条件 使用方法 期待される出力 参考資料 免責事項 概要 CVE-2026-9558は、MauticのテーマエンジンにおけるサーバーサイドテンプレートインジェクションSSTIの脆弱性です。テーママネージャを通じてアップロードされるテーマは、Twigテンプレートを含むZIPアーカイブであり、影響を受けるバージョンでは、これらのテンプレートはアプリケーションのデフォルトのTwig...

CVE-2026-22692

CVE-2026-22692: 通过 collect-mapInto 实现的关键 Twig 沙箱绕过，允许 RCE/LFI/XXE October CMS 概述 字段| 详情 ---|--- CVE 编号| CVE-2026-22692 严重性| 中等 CVSS:3.1 4.9 公告| GHSA-m5qg-jc75-4jp6 受影响产品| October CMS RCE, LFI, XXE 发现者| Lukasz Rybak CWE 分类 CWE-693: 保护机制失效 CWE-611: XML外部实体引用的不当限制 CWE-74: 下游组件输出中特殊元素的不当中和（'注入'） 摘要...

CVE-2026-78851

Grav 認証済みパストラバーサル / Twig mediadirectory による任意ディレクトリ情報漏えい 報告者 名前: CYBER-SEC 連絡先: [email protected] 概要 Grav の Twig 関数 mediadirectory は、ページコンテンツの Twig サンドボックス許可リスト内で公開されていますが、ストリーム以外の入力に対するパス封じ込めが適切に強制されていません。 ページ編集権限を持つ認証済みユーザーは、Twig が有効なページコンテンツ内で mediadirectory'/absolute/path'...

GHSA-3JHR-MXMX-38CX Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

EUVD-2026-65219

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashedpassword and 2FA secrets via offsetGet...

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

GHSA-XJW5-Q542-3VMR Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

CVE-2026-92917

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

EUVD-2026-81439

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-46696

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-46696

CVE-2026-46696 affects October CMS (system module) versions prior to 3.7.17 and 4.2.21 . A chained bypass in the Twig sandbox security policy occurs when cms.safe_mode is enabled: the Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through ...

CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...