Vulnerability-Lookup

CVE-2026-61842 (GCVE-0-2026-61842)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:23 – Updated: 2026-08-19 18:18

Title

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Summary

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 18:03 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav/commit/7efe70574e…	x_refsource_MISC
https://github.com/getgrav/grav/releases/tag/2.0.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
getgrav	grav	Affected: < 2.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:03:38.784330Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:18:54.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet(\u0027config\u0027) to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:23:27.038Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j"
        },
        {
          "name": "https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6"
        },
        {
          "name": "https://github.com/getgrav/grav/releases/tag/2.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav/releases/tag/2.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-mc5q-6hpj-rp7j",
        "discovery": "UNKNOWN"
      },
      "title": "Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61842",
    "datePublished": "2026-08-19T15:23:27.038Z",
    "dateReserved": "2026-07-10T20:28:17.512Z",
    "dateUpdated": "2026-08-19T18:18:54.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-61842",
      "date": "2026-09-24",
      "epss": "0.00438",
      "percentile": "0.35351"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "grav",
                "vendor": "getgrav",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.0.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet(\u0027config\u0027) to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2."
          }
        ],
        "id": "CVE-2026-61842",
        "lastModified": "2026-09-09T21:13:25.910",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-61842",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:03:38.784330Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-19T16:18:17.003",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/releases/tag/2.0.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-61842",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-19T18:03:38.784330Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-19T18:03:39.817Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "grav",
              "vendor": "getgrav",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.0.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet(\u0027config\u0027) to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-19T15:23:27.038Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j"
            },
            {
              "name": "https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6"
            },
            {
              "name": "https://github.com/getgrav/grav/releases/tag/2.0.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getgrav/grav/releases/tag/2.0.2"
            }
          ],
          "source": {
            "advisory": "GHSA-mc5q-6hpj-rp7j",
            "discovery": "UNKNOWN"
          },
          "title": "Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-61842",
        "datePublished": "2026-08-19T15:23:27.038Z",
        "dateReserved": "2026-07-10T20:28:17.512Z",
        "dateUpdated": "2026-08-19T18:18:54.336Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-61842

Vulnerability from fkie_nvd - Published: 2026-08-19 16:18 - Updated: 2026-09-09 21:13

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6
	security-advisories@github.com	https://github.com/getgrav/grav/releases/tag/2.0.2
	security-advisories@github.com	https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet(\u0027config\u0027) to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2."
    }
  ],
  "id": "CVE-2026-61842",
  "lastModified": "2026-09-09T21:13:25.910",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61842",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-19T18:03:38.784330Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-19T16:18:17.003",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/releases/tag/2.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-MC5Q-6HPJ-RP7J

Vulnerability from github – Published: 2026-09-02 21:41 – Updated: 2026-09-02 21:41

Summary

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Details

Summary

The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist (GHSA-j274-39qw-32c9), so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on it, so grav.offsetGet('config') returns the real Config. The allow-listed filters json_encode/print_r/yaml_encode then serialize it at the PHP level, never hitting the sandbox method gate, dumping the whole config tree including every plugins.* secret (SMTP creds, API keys, plugin DB creds). Incomplete fix for GHSA-j274-39qw-32c9. security.salt does not leak (it lives outside config).

Details

The documented path is blocked: config is the SandboxConfig facade (Twig.php:660) and the raw Config/Data method entries are stripped when config_access is false, so {{ config.get(...) }} returns the default and {{ grav.offsetGet('config').get(...) }} raises SecurityNotAllowedMethodError.

The bypass uses two allow-listed primitives the redaction doesn't cover:

grav.offsetGet('config') returns the raw Config. The SandboxConfig facade replaces only the config variable, not grav['config']; offsetget is allow-listed on Grav\Common\Grav in system/config/security.yaml.
json_encode/print_r/yaml_encode serialize the object inside the filter and never call GravSecurityPolicy::checkMethodAllowed (GravSecurityPolicy.php:65), so the stripped methods don't matter.

Bug class: object-dumping filters bypass the sandbox member gate. The same dump reaches page/pages/uri/user via their allow-listed accessors; config is the secret-bearing target.

Reachable below the publisher-Twig opt-in: a _-prefixed slug is modular (Page.php:228), and Page::content() sets $process_twig = $scan_twig_xss || $this->modularTwig() (Page.php:816), so a modular child's body Twig is sandboxed-rendered even with twig_content.process_enabled false (the default), while $scan_twig_xss stays false so the render-time XSS scan (GHSA-2c4f-86xc-cr74) is skipped. Any admin.pages author (or filesystem write to user/pages) exfiltrates config on a stock install. On a regular process.twig page the whole-tree dump trips the XSS scan and is blanked, but a targeted split/slice extraction of one subtree is XSS-clean and survives.

PoC

Sandboxed render, config_access default false. First two lines show the gate holding, third is the bypass:

{{ config.get('plugins.email.mailer.smtp.password', 'DENIED') }}
{# => DENIED #}
{{ grav.offsetGet('config').get('plugins.email.mailer.smtp.password') }}
{# => SecurityNotAllowedMethodError 'get' #}
{{ grav.offsetGet('config')|json_encode }}
{# => {...,"plugins":{"email":{"mailer":{"smtp":{"password":"CANARY..."}}}},...} #}

Stock-install reproduction (no user/config/security.yaml):

# user/config/plugins/email.yaml  -- decoy secret
mailer: { smtp: { password: CANARY_SMTP_PW_8b3f1 } }

# user/pages/70.parent/default.md
---
title: Parent
content: { items: '@self.modular' }
template: modular
---

{# user/pages/70.parent/_secret/default.md #}
---
title: Secret
template: modular/text
---
{{ grav.offsetGet('config')|json_encode }}

curl -s http://localhost/parent   # body contains CANARY_SMTP_PW_8b3f1

logs/security.log shows no sandbox block and no XSS scan for the route. Verified on Grav 2.0.1 (6f619f0ae), PHP 8.4.22, Twig 3.26.1-DEV.

Impact

A page author (admin.pages, no admin/super) reads the entire config tree: plugin SMTP credentials, API keys, plugin DB credentials. Read-only. Default install; the modular path needs no Twig opt-in.

Fix

system/config/security.yaml: drop offsetget (and __get) from twig_sandbox.allowed_methods for Grav\Common\Grav -- the legit uses are theme/getversion; offsetget is the raw-container reach. Closes the demonstrated path.

Sandbox-wide: make json_encode/print_r/yaml_encode/string refuse non-allow-listed objects when $env->isSandboxed() (mirror the Closure-only guard Twig applies to map/filter/reduce). Closes the class for page/pages/uri/user too.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T21:41:12Z",
    "nvd_published_at": "2026-08-19T16:18:17Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get`/`toArray` from the method allowlist (GHSA-j274-39qw-32c9), so editor content can\u0027t read config secrets via `config`. That\u0027s bypassable: `grav` is the raw container, `offsetget` is allow-listed on it, so `grav.offsetGet(\u0027config\u0027)` returns the real `Config`. The allow-listed filters `json_encode`/`print_r`/`yaml_encode` then serialize it at the PHP level, never hitting the sandbox method gate, dumping the whole config tree including every `plugins.*` secret (SMTP creds, API keys, plugin DB creds). Incomplete fix for GHSA-j274-39qw-32c9. `security.salt` does not leak (it lives outside config).\n\n### Details\n\nThe documented path is blocked: `config` is the `SandboxConfig` facade (`Twig.php:660`) and the raw `Config`/`Data` method entries are stripped when `config_access` is false, so `{{ config.get(...) }}` returns the default and `{{ grav.offsetGet(\u0027config\u0027).get(...) }}` raises `SecurityNotAllowedMethodError`.\n\nThe bypass uses two allow-listed primitives the redaction doesn\u0027t cover:\n\n1. `grav.offsetGet(\u0027config\u0027)` returns the raw `Config`. The `SandboxConfig` facade replaces only the `config` variable, not `grav[\u0027config\u0027]`; `offsetget` is allow-listed on `Grav\\Common\\Grav` in `system/config/security.yaml`.\n2. `json_encode`/`print_r`/`yaml_encode` serialize the object inside the filter and never call `GravSecurityPolicy::checkMethodAllowed` (`GravSecurityPolicy.php:65`), so the stripped methods don\u0027t matter.\n\nBug class: object-dumping filters bypass the sandbox member gate. The same dump reaches `page`/`pages`/`uri`/`user` via their allow-listed accessors; `config` is the secret-bearing target.\n\nReachable below the publisher-Twig opt-in: a `_`-prefixed slug is modular (`Page.php:228`), and `Page::content()` sets `$process_twig = $scan_twig_xss || $this-\u003emodularTwig()` (`Page.php:816`), so a modular child\u0027s body Twig is sandboxed-rendered even with `twig_content.process_enabled` false (the default), while `$scan_twig_xss` stays false so the render-time XSS scan (GHSA-2c4f-86xc-cr74) is skipped. Any `admin.pages` author (or filesystem write to `user/pages`) exfiltrates config on a stock install. On a regular `process.twig` page the whole-tree dump trips the XSS scan and is blanked, but a targeted `split`/`slice` extraction of one subtree is XSS-clean and survives.\n\n### PoC\n\nSandboxed render, `config_access` default false. First two lines show the gate holding, third is the bypass:\n\n```twig\n{{ config.get(\u0027plugins.email.mailer.smtp.password\u0027, \u0027DENIED\u0027) }}\n{# =\u003e DENIED #}\n{{ grav.offsetGet(\u0027config\u0027).get(\u0027plugins.email.mailer.smtp.password\u0027) }}\n{# =\u003e SecurityNotAllowedMethodError \u0027get\u0027 #}\n{{ grav.offsetGet(\u0027config\u0027)|json_encode }}\n{# =\u003e {...,\"plugins\":{\"email\":{\"mailer\":{\"smtp\":{\"password\":\"CANARY...\"}}}},...} #}\n```\n\nStock-install reproduction (no `user/config/security.yaml`):\n\n```yaml\n# user/config/plugins/email.yaml  -- decoy secret\nmailer: { smtp: { password: CANARY_SMTP_PW_8b3f1 } }\n```\n\n```\n# user/pages/70.parent/default.md\n---\ntitle: Parent\ncontent: { items: \u0027@self.modular\u0027 }\ntemplate: modular\n---\n```\n\n```twig\n{# user/pages/70.parent/_secret/default.md #}\n---\ntitle: Secret\ntemplate: modular/text\n---\n{{ grav.offsetGet(\u0027config\u0027)|json_encode }}\n```\n\n```bash\ncurl -s http://localhost/parent   # body contains CANARY_SMTP_PW_8b3f1\n```\n\n`logs/security.log` shows no sandbox block and no XSS scan for the route. Verified on Grav 2.0.1 (6f619f0ae), PHP 8.4.22, Twig 3.26.1-DEV.\n\n### Impact\n\nA page author (`admin.pages`, no admin/super) reads the entire config tree: plugin SMTP credentials, API keys, plugin DB credentials. Read-only. Default install; the modular path needs no Twig opt-in.\n\n### Fix\n\n`system/config/security.yaml`: drop `offsetget` (and `__get`) from `twig_sandbox.allowed_methods` for `Grav\\Common\\Grav` -- the legit uses are `theme`/`getversion`; `offsetget` is the raw-container reach. Closes the demonstrated path.\n\nSandbox-wide: make `json_encode`/`print_r`/`yaml_encode`/`string` refuse non-allow-listed objects when `$env-\u003eisSandboxed()` (mirror the Closure-only guard Twig applies to `map`/`filter`/`reduce`). Closes the class for `page`/`pages`/`uri`/`user` too.",
  "id": "GHSA-mc5q-6hpj-rp7j",
  "modified": "2026-09-02T21:41:13Z",
  "published": "2026-09-02T21:41:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61842"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/releases/tag/2.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-61842 (GCVE-0-2026-61842)

FKIE_CVE-2026-61842

GHSA-MC5Q-6HPJ-RP7J

Summary

Details

PoC

Impact

Fix

Tags

Sightings

Nomenclature

Related by attack behaviour