# Grav UserInterface offsetGet/offsetExists Twig sandbox bypass

Source: https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-08-25

Grav is a modern, open-source flat-file CMS used to build and manage websites. Attackers with page-editing permissions could exploit a sandbox bypass to extract hashed user passwords and two-factor authentication secrets from user accounts, enabling offline password cracking and account takeovers without requiring administrator access.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 25 August 2026.

**Which products and versions are affected?** Grav < 2.0.16; getgrav/grav (Packagist) < 2.0.16.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-10: Patch released in version 2.0.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure flaw in Grav's Twig sandbox security policy. The User class allow-lists offsetGet() and offsetExists() methods in the sandbox policy (defined in system/config/security.yaml), but the concrete User implementation fails to filter sensitive fields when these methods are called. While jsonSerialize() properly redacts hashed_password, secret, and twofa_secret fields, offsetGet() returns unfiltered data. Attackers with page-edit permissions can call offsetGet() on User objects within sandboxed Twig templates to directly access these sensitive fields, bypassing intended redaction. The attack requires existing page-edit privileges and no user interaction. A patch was released in version 2.0.16 that adds field filtering to offsetGet().

## Affected products

- Grav Grav < 2.0.16

## Timeline

- 2026-08-10: disclosed: Original advisory GHSA-3jhr-mxmx-38cx published
- 2026-08-10: patched: Patch released in version 2.0.16
- 2026-08-25: other: Duplicate advisory GHSA-8vp7-8q4w-vv7m created and published
- 2026-09-17: other: Duplicate advisory withdrawn

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx](https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)