The vulnerability allows a page author to capture HTTP Basic authentication credentials of site visitors by embedding the request Uri object into a Twig template. The request Uri contains PHP_AUTH_USER and PHP_AUTH_PW values, which can be emitted as an inline style background image. This allows exfiltration of administrator credentials to an external host, leading to a loss of confidentiality for authenticated users.

Grav CMS versions 2.0.0 through 2.2.4 on any web server are affected. Upgrade to 2.2.5 or later eliminates the exposed request Uri handling.

The CVSS score of 6.9 indicates high risk. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious page author or compromised theme that can inject Twig code containing the request Uri. This requires write access to templates but does not provide further code execution. Once triggered, victim credentials are sent to an attacker-controlled host via a simple HTTP request. The exploit is straightforward, making it an attractive target for attackers who can influence page content.