Grav UserInterface offsetGet/offsetExists Twig sandbox bypass

Severity: medium · CVSS 6.5 · Published 2026-08-25

Grav is a modern, open-source flat-file CMS used to build and manage websites. Attackers with page-editing permissions could exploit a sandbox bypass to extract hashed user passwords and two-factor authentication secrets from user accounts, enabling offline password cracking and account takeovers without requiring administrator access.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.5, published 25 August 2026.
Which products and versions are affected?
Grav < 2.0.16; getgrav/grav (Packagist) < 2.0.16.
Is there a fix for This vulnerability?
A patch was published on 2026-08-10: Patch released in version 2.0.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw in Grav's Twig sandbox security policy. The User class allow-lists offsetGet() and offsetExists() methods in the sandbox policy (defined in system/config/security.yaml), but the concrete User implementation fails to filter sensitive fields when these methods are called. While jsonSerialize() properly redacts hashed_password, secret, and twofa_secret fields, offsetGet() returns unfiltered data. Attackers with page-edit permissions can call offsetGet() on User objects within sandboxed Twig templates to directly access these sensitive fields, bypassing intended redaction. The attack requires existing page-edit privileges and no user interaction. A patch was released in version 2.0.16 that adds field filtering to offsetGet().

Affected products

  • Grav Grav < 2.0.16

Timeline

  • 2026-08-10: disclosed: Original advisory GHSA-3jhr-mxmx-38cx published
  • 2026-08-10: patched: Patch released in version 2.0.16
  • 2026-08-25: other: Duplicate advisory GHSA-8vp7-8q4w-vv7m created and published
  • 2026-09-17: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.