Grav versions from 2.0.0 up to but not including 2.2.2 have a flaw that allows page editors to add special config-*@ directives to page frontmatter forms. This bypasses the Twig sandbox’s config_denied_paths setting and exposes hidden values such as security.salt, plugin credentials and Redis passwords to anyone who can view the page. The vulnerability is identified as an information disclosure (CWE-200) and can compromise the confidentiality of critical configuration data.

Grav, developed by getgrav, is affected. Versions from 2.0.0 up to but not including 2.2.2 have the issue. Versions 2.2.2 and later include the fix.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, suggesting insufficient data on exploit likelihood, but the lack of KEV listing implies no confirmed exploitation yet. Attackers must have page-edit permissions and exploit the form configuration feature to read the hidden values. Once the config-*@ directives are added, the sandbox bypass reveals sensitive data to all visitors, creating a broad impact on confidentiality.