Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9 Exploit, Vendor Advisory
- https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.7 · getgravNVD modified 2026-10-26 18:10
Affected (CPE criteria) 6
cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*cpe:2.3:a:getgrav:grav:2.0.0:beta1:*:*:*:*:*:*cpe:2.3:a:getgrav:grav:2.0.0:beta2:*:*:*:*:*:*cpe:2.3:a:getgrav:grav:2.0.0:beta3:*:*:*:*:*:*cpe:2.3:a:getgrav:grav:2.0.0:beta4:*:*:*:*:*:*cpe:2.3:a:getgrav:grav:2.0.0:rc1:*:*:*:*:*:*
References 2
- https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9 Exploit, Vendor Advisory
- https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9 Exploit, Vendor Advisory