# Grav CMS Twig sandbox bypass in configuration variables

Source: https://junglewise.ai/threats/grav-cms-twig-sandbox-bypass-in-configuration-variables-342f3ed2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-08-25

Grav CMS is a flat-file content management system used to build websites without a database. A vulnerability in its template sandbox allows content editors to read sensitive configuration values—including database credentials, cache passwords, and API keys—by directly accessing configuration arrays in Twig templates, bypassing the intended access restrictions. This affects any Grav installation where users have page-content editing privileges.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 25 August 2026.

**Which products and versions are affected?** getgrav/grav (Packagist) < 2.0.16.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-10: Version 2.0.16 patched the primary advisory GHSA-p597-crqc-m349 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information-disclosure flaw in the Twig template sandbox implementation. Grav's Twig::init() method unconditionally exposes raw system, site, and theme configuration arrays into the template context, and processPage() copies these unfiltered into sandboxed renders. Although a filtered config facade is substituted, the system, site, and theme arrays bypass the sandbox entirely since Twig's SecurityPolicy only gates method/property access on objects—not array subscript or dot notation access. An attacker with page-content edit access can use Twig expressions like {{ system.cache.redis.password }} to read nested secret values, completely bypassing config_denied_paths restrictions. No patch is available as of the advisory date; the vulnerability was fixed in version 2.0.16 (though this advisory is marked withdrawn as a duplicate).

## Affected products

- Grav Grav CMS < 2.0.16

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: advisory
- 2026-08-10: patched: Version 2.0.16 patched the primary advisory GHSA-p597-crqc-m349

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-p597-crqc-m349](https://github.com/getgrav/grav/security/advisories/GHSA-p597-crqc-m349)

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)