CVE-2026-100668: Grav before 2.0.25 Sandbox Escape via array Filter
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter (and its identical function form) is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray() — or falls back to an (array) cast — without consulting the sandbox method allowlist. Because the grav Twig global is the raw Pimple-based dependency injection container, a user who can author Twig in page content can evaluate grav|array to read the container's private $values array, including the un-redacted Config service; a second array cast returns the entire configuration tree, disclosing plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs and the security. subtree that the sandbox's redaction is meant to hide. Because the payload is stored in page content, the disclosed configuration is rendered to anonymous visitors. Grav 1.7 is not affected as it has no Twig content sandbox. Fixed in Grav 2.0.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to author Twig in Grav page content. The vulnerable payload can then be stored in that content and its output rendered to anonymous visitors.
What information could be exposed?
The issue can disclose the raw dependency-injection container's configuration, including plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the security.* configuration subtree.
Are default Grav installations affected?
The issue affects Grav 2.0.0 through 2.0.24 when a user can author Twig in page content. Grav 1.7 is not affected because it does not have the Twig content sandbox.
What should be done if updating is not immediately possible?
Restrict the ability to author Twig in page content, since this capability is required to use the sandbox escape. Review existing page content for use of the array filter or its function form, particularly against the grav Twig global.
How can administrators determine whether they may already be affected?
Inspect page content authored by potentially untrusted users for Twig expressions using grav|array or the identical array function form. Because malicious content can render disclosed configuration to anonymous visitors, review published pages as well as unpublished or recently edited content.