CVE-2026-72698

Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Published Aug 25, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

Analysis

Technical impact

Grav CMS before version 2.0.16 does not properly filter system, site, and theme configuration arrays when rendering sandboxed Twig templates, allowing content editors to read sensitive configuration values such as cache credentials by using dot notation in Twig templates. This flaw represents a classic Information Disclosure weakness (CWE‑200).

Affected Systems

The vulnerability affects the Grav CMS product (getgrav:grav). All installations running any version earlier than 2.0.16 are susceptible; the specific version numbers are not listed in the advisory, but any instance before that patch is impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium‑to‑high severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers need only page‑content edit access to exploit the issue; the bypass is achieved through dot notation usage in Twig templates, which is not restricted by the config_denied_paths mechanism. Once exploited, an attacker can read raw configuration arrays and potentially obtain confidential credentials, increasing the risk to the confidentiality of the system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

getgrav

grav

unaffected

Version	Status	Constraints
`0`	affected	< 2.0.16
`2.0.16`	unaffected	—

No data.

Vendor Product Versions

Getgrav

Grav

Version	Status	Scheme	Platform
`[0,2.0.16)`	affected	semver	—
`2.0.16`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Grav CMS 2.0.16 patch or later to eliminate the sandbox bypass.
Restrict page‑content edit permissions to trusted users or reduce the scope of content editor capabilities to minimize exposure.
Audit existing Twig templates for dot notation references to configuration arrays and refactor or remove them to ensure no unintended data leaks.

Generated by OpenCVE AI on August 25, 2026 at 03:22 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-p597-crqc-m349	Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.409% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/getgrav/grav/security/advisories/GHSA-p597-crqc-m349
https://www.vulncheck.com/advisories/grav-cms-before-information-disclosure-via-twig-sandbox-bypass

History

Aug 27, 2026 6:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 25, 2026 2:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.
Title		Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
First Time appeared		Getgrav Getgrav grav
Weaknesses		CWE-200
CPEs		cpe:2.3:a:getgrav:grav::::::::
Vendors & Products		Getgrav Getgrav grav
References		https://github.com/getgrav/grav/security/advisories/GHSA-p597-crqc-m349 https://www.vulncheck.com/advisories/grav-cms-before-information-disclosure-via-twig-sandbox-bypass
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`