The vulnerability arises from the Grav Admin2 plugin before version 2.0.4, which embeds the global JavaScript object window.__GRAV_CONFIG__ into the Admin2 single-page application bootstrap page served at /grav/admin and its subroutes. This object is included in every response regardless of authentication status and reveals the server URL, API prefix, admin base path, runtime environment type, and the exact Grav and Admin2 version numbers. According to the CWE list, this is an instance of Information Exposure (CWE-200). The disclosed data allows an unauthenticated attacker to identify the software stack, determine potential version-specific weaknesses, and craft tailored attacks without the need for additional reconnaissance.

The affected product is the Grav Admin2 plugin for Grav Core, specifically all releases prior to 2.0.4. The vendor, obtainable via the CNA identifier, is getgrav. Users running Grav Core with the Admin2 plugin older than 2.0.4 are impacted.

With a CVSS score of 8.7, the vulnerability is considered high severity. The EPSS score is < 1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV. The exploit is remote and passive: any unauthenticated user can retrieve the /grav/admin page (or any of its subroutes) over HTTP or HTTPS and read the embedded JavaScript variable. While the exploit itself only leaks information, the precise version disclosure can be leveraged by an attacker to select and deploy more dangerous, version-specific exploits against the same host.