Grav CMS CVE-2026-100668

Requires an authenticated account with permission to author raw Twig in page content on Grav 2.0.0-2.0.24 with the Twig content sandbox enabled (the sandbox is the very feature being escaped); Grav 1.7 is not affected because it has no Twig content sandbox. Exploitation is limited by this authoring privilege (PR:L, not anonymous write) but is amplified because the stored payload's output is then served to unauthenticated visitors, and no user interaction or non-default configuration is otherwise needed. Effective secret disclosure also depends on the target having populated config secrets (SMTP/OAuth/Redis/proxy) worth harvesting.

This is a genuine but moderate-priority information-disclosure flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, score 7.1) is internally consistent with the description: network-reachable, low complexity, requiring low privileges (the ability to author Twig in page content), no user interaction, high confidentiality impact only. No EPSS score, KEV listing, or public POC is present in the input, so there is no signal of active or automated exploitation - exploitation status is 'no public exploit identified at time of analysis.' The realistic risk driver is the privilege model: an attacker must already hold a content-authoring role that permits raw Twig, which is not anonymous access, so this is a privilege-boundary/insider or compromised-editor risk rather than a mass-exploitable unauth bug. The severity is elevated by the payoff - a single grav|array cast dumps the entire un-redacted config tree (SMTP/OAuth secrets, Redis passwords, proxy URLs, plugin credentials) and, because the payload is stored in page content, the leaked secrets are then rendered to anonymous site visitors, effectively laundering the disclosure to the public and enabling lateral movement into the referenced external services. No conflicting signals: CVSS network vector matches the description's web-content delivery. Missing data: no EPSS/KEV/POC (absence, not error).

An attacker who holds a Grav content-authoring account with Twig privileges (or who has compromised such an account) inserts {{ grav|array|array }} into a page. When the page renders, Grav evaluates the array filter without the sandbox guard, dumping the DI container's private $values including the full un-redacted configuration, which is then displayed to any anonymous visitor loading the page - exposing SMTP, OAuth, Redis, and proxy credentials. No public exploit code is identified, but the payload is a trivial one-line Twig expression.