Executive brief
A vulnerability in the Grav content management system allows users with basic page-editing permissions to access the website's entire configuration file. This file often contains highly sensitive information, such as email passwords, AWS security keys, and API tokens for other services. An attacker with an editor account could use this to steal credentials and compromise other business systems and cloud infrastructure.
Technical details
A vulnerability exists in Grav's Twig sandbox configuration where the 'Config::toArray()' method is explicitly permitted in the security allow-list. Users with 'admin.pages' privileges can create or edit a page, enable Twig processing in the frontmatter, and use a Twig payload to dump the entire merged site configuration into the rendered HTML. This configuration object contains sensitive plugin secrets, including SMTP passwords, AWS keys, and OAuth tokens. The issue is rooted in 'system/config/security.yaml' and affects versions up to 2.0.0-rc.1. A patch is available in version 2.0.0-rc.2.
Affected products
- getgrav Grav <= 2.0.0-rc.1
Timeline
- 2026-05-09: disclosed
- 2026-05-11: advisory: NVD publication date
- 2026-05-13: patched: GitHub Advisory reviewed and updated