CVE-2026-72698: Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the configdeniedpaths restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav CMSto a version that resolves this vulnerability.Fixed in 2.0.16 - Compensating control
Ensure page content edit access is restricted/controlled (e.g., only trusted users can edit content) to reduce the ability to use Twig dot-notation to read sensitive configuration values.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs page-content edit access in Grav CMS. They can use Twig templates with dot notation to read raw system, site, and theme configuration arrays.
What information could be exposed?
Sensitive configuration values stored in the affected arrays may be disclosed, including secrets such as cache credentials. The issue bypasses config_denied_paths restrictions during sandboxed Twig rendering.
Which deployments are affected?
Grav CMS versions before 2.0.16 are affected where a user with page-content editing access can submit or modify Twig-rendered content.