CVE-2026-92917: Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (printr, vardump, jsonencode, yamlencode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|printr }} in page content with Twig processing enabled and dump Grav's entire merged configuration — printr reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needsissandboxed flag.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.22Patch GHSA-mc5q-6hpj-rp7j
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has page-edit rights can exploit it, provided they can place Twig content in page content where Twig processing is enabled. No additional privileges or user interaction are required.
What information could be exposed?
An attacker can dump Grav's merged configuration, including plugin secrets such as SMTP credentials, API tokens, webhook secrets, and cache backend passwords. The print_r output can access the real Config object and bypass the SandboxConfig facade's path redaction.
Which deployments are affected?
Grav versions 2.0.0-rc.1 through 2.0.21 are affected. Grav 1.7 is not affected, and the issue is fixed in Grav 2.0.22.
What should be done if an affected system may have been exposed?
Upgrade to Grav 2.0.22. Because configuration output may include credentials and secrets, rotate any SMTP credentials, API tokens, webhook secrets, and cache backend passwords that could have been available in the merged configuration.