Grav, a flat‑file CMS, renders user‑submitted page content through a Twig sandbox during page rendering. The sandbox mistakenly allows the get_cookie() function, which returns all cookies sent with the request without regard to the HttpOnly, Secure or SameSite flags. A user with only page‑write permission can publish Twig code that calls get_cookie() to capture the administrator's session cookie when the admin next visits the page. The output, stripped of any request or session information, is then cached and served to every visitor. An unauthenticated visitor can replay that captured cookie and authenticate as the administrator, resulting in full administrative access. The flaw thus enables remote session hijacking and compromised account takeover.

Grav versions 2.0.19 through 2.0.24, as well as 2.0.0 through 2.0.18 when content Twig is enabled, and the 1.7.x series under the same condition, are affected. The vulnerability exists because the Security::applyTwigContentDefault() routine permits content Twig to run on every page without request or session context. The issue was fixed in Grav 2.0.25; the 1.7.x branch was not backported.

With a CVSS score of 8.6, the flaw is considered high severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog. The attack requires the attacker to be a page‑write user who can publish Twig code; the vulnerability is not trivially exploitable by an unauthenticated attacker. However, once a malicious page is published, any administrator who views that page will have his or her session cookie exposed to attackers. Environments that allow broad write permissions or enable content Twig should treat this as a critical real‑world risk.