Grav's Twig sandbox is designed to limit user‑generated content, but the grav.offsetGet('config') call exposes the raw configuration object. This object can be serialized using json_encode, print_r, yaml_encode, or string filters without being checked by the sandbox’s security policy. An attacker who can create or modify a page with author permissions can therefore render a page that outputs the entire configuration, leaking SMTP credentials, API keys, and database passwords. The flaw is an instance of CWE‑200, Information Exposure.

The vulnerability affects all Grav installations built with the Twig sandbox before version 2.0.2. It is present in GetGrav’s Grav product, specifically in Grav 2.0.1 and earlier releases. The issue was addressed in Grav 2.0.2 and later versions.

The flaw carries a CVSS score of 6.5. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to render sandboxed content with page‑author rights, a privilege that many users on typical sites possess. No additional credentials, network access, or code execution is needed. The attack path is therefore relatively straightforward, giving a moderate but non‑negligible risk, especially for sites where several users hold page‑author permissions or where configuration secrets are kept in a single site configuration file.