EUVD-2026-29135
GHSA-j274-39qw-32c9
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration - including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) - into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.
AnalysisAI
Information disclosure in Grav CMS versions prior to 2.0.0-rc.2 allows authenticated users with admin.pages role to extract all site configuration secrets via Twig sandbox bypass. Attackers can invoke config.toArray() from page content to dump SMTP passwords, AWS keys, OAuth client secrets, and API tokens into rendered HTML. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Grav CMS instances and their current versions using asset inventory; audit admin.pages role assignments to minimize privileged user count. Within 7 days: Restrict admin.pages role to only essential personnel; implement code review workflows for page content before publication. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today