Is CVE-2026-92917 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92917 being exploited in the wild.

How severe is CVE-2026-92917?

High severity, with a CVSS score of 7.5, published 17 September 2026.

Which products and versions are affected?

Grav 2.0.0-rc.1 through 2.0.21.

Is there a fix for CVE-2026-92917?

A patch was published on 2026-09-17: Fix released in Grav 2.0.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92917 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92917?

Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92917: Grav Twig sandbox configuration disclosure via print_r

CVE-2026-92917 · Severity: high · CVSS 7.5 · Published 2026-09-17

Grav is a flat-file content management system used to build and manage websites. Authenticated users with basic page-editing permissions can bypass the security sandbox and expose the entire site configuration—including SMTP credentials, API tokens, and webhook secrets—by embedding a simple print_r command in page content. This allows low-privilege attackers to steal sensitive plugin configuration that operators intended to hide.

Technologies: Grav. Vendors: Grav.

Quick answers

Is CVE-2026-92917 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92917 being exploited in the wild.
How severe is CVE-2026-92917?: High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?: Grav 2.0.0-rc.1 through 2.0.21.
Is there a fix for CVE-2026-92917?: A patch was published on 2026-09-17: Fix released in Grav 2.0.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92917 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92917?: Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incomplete fix for CWE-200 (information exposure) in Grav's Twig template sandbox. The GravExtension::assertSandboxDumpSafe() method was added to guard the print_r, vardump, json_encode, yaml_encode, and string filters, but it calls SandboxExtension::isSandboxed() without a Source argument, checking only a global sandbox flag that Grav never enables—causing the guard to never execute. An authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled to dump the full merged configuration, bypassing the SandboxConfig facade's path redaction because print_r directly accesses the real Config object held in a private property. The attack requires authentication and page-edit permissions, but no user interaction. The fix, released in version 2.0.22, registers the affected filters with Twig's needs_is_sandboxed flag to receive the correct per-template sandbox state.

Affected products

Grav Grav 2.0.0-rc.1 through 2.0.21

Timeline

2026-09-02: disclosed: GitHub Security Advisory GHSA-rfr9-7h4p-gx2x published
2026-09-17: advisory: CVE-2026-92917 published to NVD
2026-09-17: patched: Fix released in Grav 2.0.22

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.