Grav CMS CVE-2026-61450

Exploitation requires an authenticated Grav account with the admin.pages permission, or any means of writing files into user/pages, so the attacker must already be able to author page content that Grav will render through Twig. There are no additional non-default feature toggles needed - the vulnerable grav.offsetGet('config') accessor and the json_encode/print_r/yaml_encode filters are on the standard sandbox allowlist. The primary limiting factor is this low-privilege authentication requirement (CVSS PR:L): a fully external, unauthenticated attacker cannot exploit it, which confines realistic risk to instances that delegate page authoring to semi-trusted or potentially compromised accounts.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and cleanly matches the described behavior: network-reachable, low complexity, requiring low privileges (a page-authoring account), no user interaction, and high confidentiality impact with no integrity or availability impact. This is a confidentiality-only, post-authentication issue - not a pre-auth RCE despite the 'RCE'/'Code Injection' tags, which describe the technique class (Twig injection) rather than achievable remote code execution here. No EPSS score, KEV listing, or SSVC decision was supplied; there is no evidence of active exploitation and no public PoC identified. The realistic priority is moderate-to-high for any Grav deployment that grants page-authoring rights to semi-trusted users, because leaked SMTP/API/DB secrets enable meaningful lateral movement and account takeover, but the required authenticated foothold limits mass, opportunistic exploitation.

A user with an admin.pages account (for example, a delegated content editor or a compromised low-privilege author account) creates or edits a page containing a crafted Twig expression such as one that calls grav.offsetGet('config') and pipes the result through json_encode or print_r. When the page renders, the real Config object is serialized in the output, revealing SMTP credentials and plugin API keys, which the attacker then reuses against those external services. No public PoC has been identified, but the vendor advisory documents the exact bypass primitive.