CVE-2026-114657: Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHPAUTHUSER and PHPAUTHPW, inside an inline style background image to exfiltrate administrators' credentials to an external host.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to credential theft?
Administrators or other visitors who access affected Grav pages while using HTTP Basic authentication are exposed. A malicious page author can cause their HTTP Basic username and password to be sent to an external host.
What access does an attacker need?
The attacker needs page-author capability sufficient to place Twig page content. Exploitation also requires a victim to visit the crafted page and interact with it in a browser.
Which versions need remediation?
Grav versions from 2.0.0 through versions before 2.2.5 are affected. Upgrade to 2.2.5 or later.
What can be done while patching is delayed?
Restrict untrusted users from authoring or modifying Twig page content, especially content that can render inline styles. Avoid using HTTP Basic authentication when accessing pages authored by users who are not fully trusted.