CVE-2026-76846: Grav before 2.0.16 Information Disclosure via Twig Sandbox
Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when configaccess is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.16 - Configuration
Update Grav to v2.0.16 to fix the incomplete default denylist in the Twig sandbox configuration that allows access to sensitive system configuration secrets when config_access is enabled.
Twig Sandbox (Grav) default denylist = complete default denylist to block access to system configuration secrets (e.g., prevent access to system.cache.redis.password via config.get()/config.toArray())
Event History
Frequently Asked Questions
Who is exposed to this issue?
Grav installations before 2.0.16 are affected when Twig sandboxing permits page editors and config_access is enabled. The attacker needs page-edit permission; exploitation does not require prior administrative access.
What information could an attacker obtain?
An attacker can use config.get() or config.toArray() in Twig templates to read system configuration values that the incomplete denylist does not block. This can include sensitive secrets such as system.cache.redis.password.
What can be done if updating is not immediately possible?
Disable config_access for page editors or otherwise remove their ability to edit pages containing Twig templates. This prevents the stated template-based access to configuration values.
How can I determine whether an installation may have been exposed?
Check whether the installation is running a Grav version earlier than 2.0.16, has config_access enabled, and grants page-edit permissions. Review Twig templates created or modified by page editors for calls to config.get() or config.toArray().