CVE-2026-112781: Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox configdeniedpaths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to edit pages. They can add config-*@ directives to page frontmatter forms, after which the exposed configuration can be disclosed to site visitors.
What sensitive data could be exposed?
The issue can expose configuration values that are meant to be redacted by Twig sandbox config_denied_paths, including security.salt, plugin credentials, and Redis passwords.
Which versions are affected?
Grav versions from 2.0.0 before 2.2.2 are affected. Version 2.2.2 is not included in the affected range.
Does exploitation require visitor interaction or elevated administrative access?
No visitor interaction is required. The stated prerequisite is page-edit permission; the vulnerability does not require the attacker to have higher administrative privileges.