Executive brief
Grav is a flat-file content management system that allows administrators to optionally enable Twig template access in user-editable pages. When this feature is enabled, an incomplete security allowlist fails to block access to sensitive system configuration values such as Redis passwords. An attacker with page-editing permissions can exploit this to extract secrets stored in the system configuration.
Technical details
Grav versions before 2.0.16 ship an incomplete default denylist in the Twig sandbox configuration (twig_sandbox.config_denied_paths in system/config/security.yaml). The denylist includes 'plugins', 'streams', 'security', 'backups', and 'scheduler' but omits 'system', which contains sensitive values like system.cache.redis.password. When config_access is enabled (a non-default setting intended to safely expose low-sensitivity values), any user with page-edit permission can call config.get() or config.toArray() in Twig templates to retrieve secrets. This is a follow-up gap to the fix for GHSA-j274-39qw-32c9. The patch in version 2.0.16 adds 'system' to the denylist.
Affected products
- Grav Grav <2.0.16
Timeline
- 2026-08-25: disclosed
- 2026-08-10: patched: Version 2.0.16 released