Executive brief
Grav is a flat-file CMS that allows editors to author content using Twig templates. A user with only page-write permission can craft a page that captures an administrator's session cookie when they view it, then serve that cookie to unauthenticated visitors who can replay it to take over the admin account. The vulnerability exists by default in affected versions due to overly permissive Twig sandboxing combined with a global page-content cache that stores captured cookies for all users.
Technical details
The vulnerability stems from three converging issues: (1) the Twig sandbox allowlists get_cookie() without name restrictions, allowing page content to read any cookie including session identifiers; (2) content Twig runs by default on all pages in 2.0.19+ via Security::applyTwigContentDefault(), requiring no frontmatter opt-in; (3) post-Twig output is cached globally keyed only on page identity and config checksum with no session, user, or request dimension. An attacker with page-write access can compute the session cookie name using exposed configuration (system.session.name) and derive the uniqueness suffix from base_dir's MD5 hash, then embed get_cookie() in page content to harvest cookies from visiting administrators and replay them to authenticate as those users.
Affected products
- Getgrav Grav 2.0.0 through 2.0.24 (2.0.19-2.0.24 vulnerable by default; 2.0.0-2.0.18 only with content Twig explicitly enabled); 1.7.x only with content Twig explicitly enabled
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 2.0.25