Grav CMS CVE-2026-114657

Exploitation requires all of the following: (1) the Grav site must be protected by HTTP Basic authentication so that the PHP_AUTH_USER and PHP_AUTH_PW values exist in the request Uri object - without Basic auth there are no credentials to capture; (2) the attacker must already hold a page-author account with permission to write raw Twig/HTML page content (PR:L); and (3) a victim holding valid credentials, typically an administrator, must actively view the attacker-authored page (UI:P), at which point their browser issues the outbound background-image request carrying the credentials to an external host. Limiting factors that reduce real-world risk: it is not remotely exploitable by an anonymous user, it fails against deployments that do not use HTTP Basic auth, it depends on a privileged victim choosing to render the malicious page, and it affects only Grav versions 2.0.0 through 2.2.4 (fixed in 2.2.5).

This is a moderate-severity, precondition-heavy information disclosure flaw rather than a drop-everything priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N) scores 6.9 (Medium) and tells a consistent story: network-reachable but requiring an authenticated low-privilege page-author account (PR:L) and passive victim interaction (UI:P), with high confidentiality impact and no integrity/availability impact - matching the CWE-200 credential-disclosure nature. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit was referenced, so this is 'no public exploit identified at time of analysis.' The realistic threat model is essentially an insider or a compromised/malicious contributor account: the attacker must already be a trusted page author, the deployment must actually use HTTP Basic authentication (so PHP_AUTH_USER/PHP_AUTH_PW are populated), and a credential-bearing administrator must view the malicious page. These stacked conditions, combined with the absence of KEV/POC/EPSS signals, argue for prioritized patching but not emergency response. One caveat to verify with the vendor: the disclosure crosses user authority (one author's content harvests another user's credentials), which arguably warrants a scope change in CVSS 3.1 terms even though the 4.0 subsequent-system metrics were set to N.

A low-privileged page author on a Grav site that is fronted by HTTP Basic authentication creates a page whose Twig content prints the request Uri object inside an inline CSS background-image URL pointing to an attacker-controlled host. When an administrator (whose browser holds valid Basic credentials) views that page, the embedded PHP_AUTH_USER and PHP_AUTH_PW values are rendered into an outbound image request and exfiltrated to the attacker. No public exploit code was referenced, so exploitation would currently require an attacker to craft the Twig payload themselves.