Grav CMS CVE-2026-44738

Attacker must possess valid credentials for a Grav CMS account with admin.pages role explicitly granted. This role is typically assigned to content editors and authors but does NOT require full administrator privileges or access to system configuration files. The vulnerability affects default Grav installations with standard Twig processing enabled for page content - no non-default plugins or configuration changes are required. Exploitation requires the ability to create or edit page content through the Grav admin panel (port 80/443 access to /admin route). Limiting factors: network access to the Grav admin interface (often restricted by IP allowlisting in production), valid authentication credentials (PR:L in CVSS), and the target site must store sensitive credentials in Grav config files rather than environment variables or external secret managers. Sites using least-privilege role assignment that restrict admin.pages to fully trusted internal staff are not practically exploitable.

Real-world risk is High for multi-user Grav installations where admin.pages role is delegated to content editors or external contributors. The CVSS 7.7 score accurately reflects the attack profile: network-based (AV:N), low complexity (AC:L), requires only low-privilege authentication (PR:L), and achieves high confidentiality impact with scope change (S:C). The scope change metric is critical - it means a content editor can extract secrets for AWS S3 buckets, SendGrid SMTP, or OAuth apps managed by site owners, enabling lateral movement to external services. Attack complexity is genuinely low because Twig expressions are a documented feature for content authors; no exploit development is required. However, exploitation requires specific conditions: the attacker must have valid credentials with admin.pages role and access to page editing functions. This limits exposure compared to unauthenticated RCE but remains severe for platforms using role-based access control to separate content creation from infrastructure management. EPSS score unavailable and no CISA KEV listing suggests exploitation has not reached widespread automated scanning or criminal adoption. Absence of confirmed POC in public repositories reduces immediate risk for unpatched systems but does not eliminate it - the attack technique is trivial to reproduce from the description. Priority should be High for any Grav instance with multiple administrative users or guest content contributors.

A freelance content editor with admin.pages access to a corporate Grav site creates a new page titled 'Test Draft' and embeds {{ config.toArray() }} in the page body. Upon saving and previewing the page, the rendered HTML displays the site's entire configuration array, including the SMTP password for the company's SendGrid account and AWS access keys for S3 media storage. The editor copies these credentials and uses them to access the company's email infrastructure and cloud storage, exfiltrating customer data and sending phishing emails from legitimate company domains. No public exploit code is required - the attack uses documented Twig templating features available in the Grav admin interface.