Executive brief
Grav CMS allows page content editors to read sensitive system configuration values through Twig templating, including cached credentials and secrets, because the Twig sandbox only restricts object property access but cannot prevent array key access. An attacker with permission to edit page content can extract secrets like database passwords and API keys that were intended to be protected from unprivileged users.
Technical details
The vulnerability is a sandbox bypass in Grav's Twig template rendering. The `Twig::init()` method copies raw PHP arrays (`system`, `site`, `theme`) from the configuration into the Twig variable set. When `processPage()` builds the sandbox environment for editor-authored content, it replaces only the `config` variable with a filtered facade object but leaves the raw arrays untouched. Twig's sandbox `SecurityPolicy` only restricts method calls and property access on objects; it cannot prevent array subscript access in templates. An attacker with page-content edit access (controlled by `security.twig_content.process_enabled`) can read `{{ system.cache.redis.password }}` and other nested secrets from these unfiltered arrays. The `config_denied_paths` mechanism, which was added to prevent similar leaks via the `config` variable, does not apply to plain arrays. The fix is to strip or replace these variables in sandboxed renders using a facade pattern similar to the existing `SandboxConfig` object.
Affected products
- Grav CMS 2.0.15 and likely other versions
Timeline
- 2026-09-17: disclosed: Advisory published
- 2026: other: Known CVE-2026-72698 assigned