Grav CMS CVE-2026-72698

Exploitation requires an authenticated session with page-content edit permissions in Grav CMS - specifically the ability to save and render Twig template expressions within page content. This is a non-default privilege for anonymous or public users; it is standard for any account granted the content editor role. The bypass operates specifically within the sandboxed Twig render context; attackers without edit access to pages cannot trigger the vulnerable code path. The config_denied_paths configuration must be present as the intended (but bypassable) restriction mechanism. Exploitation is limited by: (1) the requirement for valid editor-level credentials (PR:L), (2) the need to submit and render Twig content, and (3) the attack produces only confidentiality impact - no code execution or data modification is achievable via this vector alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) places this as a network-reachable, low-complexity vulnerability requiring low-privilege access, with high confidentiality impact and no integrity or availability impact. The PR:L requirement is the primary mitigating factor - exploitation is gated on possessing authenticated content editor credentials, ruling out unauthenticated or opportunistic mass exploitation. No EPSS data was supplied in the input, and this CVE is absent from the CISA KEV catalog, suggesting no confirmed widespread active exploitation at time of analysis. No public POC has been identified. The practical risk is highest in multi-tenant or multi-author Grav deployments where editors are not fully trusted - a configuration common in agencies, community sites, or delegated publishing workflows - and lowest in single-operator installs where the site owner is also the sole editor. The straightforward exploitation technique (standard Twig dot notation) means a knowledgeable attacker with editor access could reliably extract secrets without needing custom tooling. The missing EPSS score and absence of KEV listing collectively point toward a low probability of opportunistic exploitation, but the high confidentiality impact on credential material makes it a meaningful priority for affected deployment patterns.

An attacker obtains content editor credentials for a Grav CMS site - through phishing, credential stuffing, or insider access - and logs into the admin panel. They create or edit a page whose content contains a Twig template expression using dot notation to traverse the system or site configuration arrays, bypassing config_denied_paths, and the rendered output reveals values such as cache service passwords or API keys. No public POC has been identified, but the technique requires only familiarity with Twig templating syntax and editor-level session access.