Executive brief
Grav is a flat-file CMS that uses a Twig templating sandbox to prevent page editors from accessing sensitive configuration. A flaw in the sandbox allows any page author to read the entire configuration tree—including SMTP passwords, API keys, and database credentials for plugins—by exploiting two allowed operations: accessing the raw container via `offsetGet` and serializing objects with filters like `json_encode`. This affects default installations without custom security overrides.
Technical details
The vulnerability is a sandbox bypass combining two allow-listed primitives. The `SandboxConfig` facade replaces the `config` variable and strips dangerous methods, but `grav.offsetGet('config')` retrieves the raw `Config` object because the sandbox only replaces the variable, not the underlying container. The allow-listed dump filters (`json_encode`, `print_r`, `yaml_encode`) serialize objects at the PHP level without calling the sandbox method gate, so the stripped methods are irrelevant. The exploit is reachable on stock installs through modular page content (pages with `_`-prefixed slugs), which are sandboxed-rendered even with `twig_content.process_enabled` false, bypassing the XSS scan. Minimal privileges required: any `admin.pages` author or filesystem write access to `user/pages`. The leak is read-only and does not include `security.salt`, which lives outside the config tree.
Affected products
- getgrav grav < 2.0.2
Timeline
- 2026-09-02: disclosed: GitHub Security Advisory published
- 2026-09-02: patched: Fixed in Grav 2.0.2
- 2026-08-19: kev added: Published to NVD