Grav CMS before version 2.0.16 does not properly filter system, site, and theme configuration arrays when rendering sandboxed Twig templates, allowing content editors to read sensitive configuration values such as cache credentials by using dot notation in Twig templates. This flaw represents a classic Information Disclosure weakness (CWE‑200).

The vulnerability affects the Grav CMS product (getgrav:grav). All installations running any version earlier than 2.0.16 are susceptible; the specific version numbers are not listed in the advisory, but any instance before that patch is impacted.

The CVSS score of 7.1 indicates a medium‑to‑high severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers need only page‑content edit access to exploit the issue; the bypass is achieved through dot notation usage in Twig templates, which is not restricted by the config_denied_paths mechanism. Once exploited, an attacker can read raw configuration arrays and potentially obtain confidential credentials, increasing the risk to the confidentiality of the system.