CVE-2026-72698 — Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. A…
Published: 2026-08-25 · CVSS: 7.1 · CVSS 4.0
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7