Executive brief
Grav is a flat-file content management system used to build and manage websites. Authenticated users with basic page-editing permissions can bypass the security sandbox and expose the entire site configuration—including SMTP credentials, API tokens, and webhook secrets—by embedding a simple print_r command in page content. This allows low-privilege attackers to steal sensitive plugin configuration that operators intended to hide.
Technical details
The vulnerability is an incomplete fix for CWE-200 (information exposure) in Grav's Twig template sandbox. The GravExtension::assertSandboxDumpSafe() method was added to guard the print_r, vardump, json_encode, yaml_encode, and string filters, but it calls SandboxExtension::isSandboxed() without a Source argument, checking only a global sandbox flag that Grav never enables—causing the guard to never execute. An authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled to dump the full merged configuration, bypassing the SandboxConfig facade's path redaction because print_r directly accesses the real Config object held in a private property. The attack requires authentication and page-edit permissions, but no user interaction. The fix, released in version 2.0.22, registers the affected filters with Twig's needs_is_sandboxed flag to receive the correct per-template sandbox state.
Affected products
- Grav Grav 2.0.0-rc.1 through 2.0.21
Timeline
- 2026-09-02: disclosed: GitHub Security Advisory GHSA-rfr9-7h4p-gx2x published
- 2026-09-17: advisory: CVE-2026-92917 published to NVD
- 2026-09-17: patched: Fix released in Grav 2.0.22