Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.
CVE-2026-72698
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-72698
grav
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "getgrav",
"product": "grav",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.0.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.0.16",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/getgrav/grav",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-72698
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #12821 · Revision 1
- Added to Heist Feed
- Publisher date