Which versions of Grav CMS are affected by CVE-2026-72698?

Grav CMS versions prior to 2.0.16 allow authenticated content editors to extract sensitive system credentials and configuration secrets through Twig template injection.. A patch is available.

How to fix or mitigate CVE-2026-72698?

Within 24 hours, inventory all Grav CMS instances and their versions; immediately audit and document all users with content editor privileges. Within 7 days, apply the principle of least privilege to editor roles, restricting template rendering capabilities where possible, and implement audit logging for configuration access attempts. Within 30 days, upgrade Grav CMS to version 2.0.16 or later when released by the vendor to patch the Twig sandbox filter bypass.

Grav CMS CVE-2026-72698

Q: What is the CVSS score of CVE-2026-72698?

CVE-2026-72698 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-65212 HIGH

Information Exposure (CWE-200)

2026-08-25 VulnCheck

GHSA-mw85-cjh9-8hp7

Information Disclosure Grav Getgrav

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible via authenticated editor session (PR:L); scope unchanged; exclusively confidentiality impact from configuration secret disclosure, no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 03:16 EUVD

Analysis Generated

Aug 25, 2026 - 02:23 vuln.today

CVE Published

Aug 25, 2026 - 01:30 cve.org

HIGH 7.1

DescriptionCVE.org

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

AnalysisAI

Configuration secret disclosure in Grav CMS before 2.0.16 allows authenticated content editors to extract sensitive values - including cache credentials - from system, site, and theme configuration arrays via the Twig templating engine. The sandboxed Twig render context fails to filter these configuration objects, permitting attackers to bypass the intended config_denied_paths restrictions using standard dot-notation syntax. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated session with page-content edit permissions in Grav CMS - specifically the ability to save and render Twig template expressions within page content. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) places this as a network-reachable, low-complexity vulnerability requiring low-privilege access, with high confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Grav CMS to version 2.0.16 or later, which addresses the incomplete filtering of system, site, and theme configuration arrays within sandboxed Twig renders. … Detailed patch versions, workarounds, and compensating controls in full report.