Executive brief
Grav is a modern, open-source flat-file CMS used to build and manage websites. Attackers with page-editing permissions could exploit a sandbox bypass to extract hashed user passwords and two-factor authentication secrets from user accounts, enabling offline password cracking and account takeovers without requiring administrator access.
Technical details
The vulnerability is an information disclosure flaw in Grav's Twig sandbox security policy. The User class allow-lists offsetGet() and offsetExists() methods in the sandbox policy (defined in system/config/security.yaml), but the concrete User implementation fails to filter sensitive fields when these methods are called. While jsonSerialize() properly redacts hashed_password, secret, and twofa_secret fields, offsetGet() returns unfiltered data. Attackers with page-edit permissions can call offsetGet() on User objects within sandboxed Twig templates to directly access these sensitive fields, bypassing intended redaction. The attack requires existing page-edit privileges and no user interaction. A patch was released in version 2.0.16 that adds field filtering to offsetGet().
Affected products
- Grav Grav < 2.0.16
Timeline
- 2026-08-10: disclosed: Original advisory GHSA-3jhr-mxmx-38cx published
- 2026-08-10: patched: Patch released in version 2.0.16
- 2026-08-25: other: Duplicate advisory GHSA-8vp7-8q4w-vv7m created and published
- 2026-09-17: other: Duplicate advisory withdrawn