CVE-2026-61842 Overview
CVE-2026-61842 affects Grav, a file-based web content management platform. The Twig content sandbox in versions prior to 2.0.2 allows authenticated page authors to exfiltrate sensitive configuration data. The grav.offsetGet('config') call returns the raw configuration object, and serialization filters bypass the GravSecurityPolicy::checkMethodAllowed gate. Attackers can serialize the object with json_encode, print_r, yaml_encode, or string filters to reveal plugins.* configuration secrets. Exposed data includes SMTP credentials, API keys, and plugin database credentials. The issue is classified as an information exposure weakness [CWE-200] and is resolved in Grav 2.0.2.
Critical Impact
Authenticated page authors can read SMTP credentials, API keys, and database credentials stored in Grav plugin configuration through sandboxed Twig content.
Affected Products
- Grav CMS versions prior to 2.0.2
- Grav Twig content sandbox component (GravSecurityPolicy)
- Grav installations exposing page-author permissions to untrusted users
Discovery Timeline
- 2026-08-19 - CVE-2026-61842 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-61842
Vulnerability Analysis
Grav uses a Twig sandbox to restrict what content authors can render in dynamic pages. The sandbox enforces an allowlist of classes, methods, and properties through GravSecurityPolicy::checkMethodAllowed. This gate is intended to prevent unauthorized access to internal PHP objects. The vulnerability arises because the sandbox permits grav.offsetGet('config') to return the raw configuration object without redaction. Once the object is in scope, serialization filters convert its internal state to text directly, sidestepping the method allowlist. Filters such as json_encode, print_r, yaml_encode, and string casts read object properties through PHP reflection semantics rather than through allowed accessor methods. The result is disclosure of the entire plugins.* configuration tree in rendered page output.
Root Cause
The root cause is missing type enforcement on serialization filters within the Twig sandbox policy. The policy validated method calls but did not validate whether the target object type was permitted for serialization. This design gap let sandboxed content bypass the member gate by dumping the object's PHP state directly.
Attack Vector
An authenticated user with page-author permissions creates or edits a page containing a Twig expression. The expression retrieves the config object and pipes it through a serialization filter. When the page renders, the response body contains the serialized secrets. No user interaction from an administrator is required.
);
}
+ /**
+ * True when $obj is an instance of any class in the method allowlist — i.e.
+ * a type sandboxed content is permitted to interact with at all. The
+ * dump/serialize filter guards (print_r, json_encode, yaml_encode, string)
+ * use this to refuse objects that bypass the member gate by serializing PHP
+ * state directly. Note: when `security.twig_content.config_access` is off,
+ * the raw `Config`/`Data` entries are stripped in
+ * Security::buildTwigSandboxPolicy(), so this returns false for them — only
+ * the redacting SandboxConfig facade stays allowed. (GHSA-mc5q-6hpj-rp7j)
+ */
+ public function isClassAllowed(object $obj): bool
+ {
+ foreach (array_keys($this->allowedMethods) as $class) {
+ if ($obj instanceof $class) {
+ return true;
+ }
+ }
+
+ return false;
+ }
+
public function checkPropertyAllowed($obj, $property): void
{
foreach ($this->allowedProperties as $class => $properties) {
Source: GitHub Commit 7efe705. The patch introduces isClassAllowed(), which the dump and serialize filter guards call to reject objects outside the method allowlist.
Detection Methods for CVE-2026-61842
Indicators of Compromise
- Page content or version-controlled Twig templates containing calls to grav.offsetGet('config') combined with json_encode, print_r, yaml_encode, or string filters.
- Rendered pages that emit SMTP credentials, API keys, or database connection strings in response bodies.
- Unexpected page edits by non-administrator page-author accounts referencing configuration keys under plugins.*.
Detection Strategies
- Review Grav content directories and Git history for Twig expressions that access config and pipe it through serialization filters.
- Inspect web server access logs for outbound page responses with anomalously large body sizes originating from author-controlled pages.
- Correlate CMS audit logs of page creation and edit events with subsequent secret rotation triggers.
Monitoring Recommendations
- Alert on outbound HTTP responses from Grav pages that contain patterns matching SMTP or API credential formats.
- Monitor changes to .md and .twig files under user/pages/ for the appearance of offsetGet, json_encode, yaml_encode, or print_r.
- Track authentication events for page-author accounts and flag content edits performed shortly after account provisioning.
How to Mitigate CVE-2026-61842
Immediate Actions Required
- Upgrade all Grav installations to version 2.0.2 or later.
- Rotate all secrets exposed in plugins.* configuration, including SMTP credentials, third-party API keys, and plugin database credentials.
- Audit existing page content and revision history for Twig expressions that reference the config object.
- Restrict page-author permissions to trusted users pending remediation.
Patch Information
The fix is included in Grav 2.0.2. See GitHub Release 2.0.2 and the GitHub Security Advisory GHSA-mc5q-6hpj-rp7j. The patch adds isClassAllowed() to GravSecurityPolicy and enforces class-type checks on serialization filters. When security.twig_content.config_access is disabled, raw Config and Data entries are stripped in Security::buildTwigSandboxPolicy(), leaving only the redacting SandboxConfig facade accessible.
Workarounds
- Disable the security.twig_content.config_access setting to strip raw Config and Data objects from the sandbox context.
- Revoke page-author permissions from any account that does not require Twig authoring privileges.
- Remove or replace plugins that store secrets in Grav configuration files with external secret management until patching completes.
# Upgrade Grav to a patched release
cd /path/to/grav
bin/gpm selfupgrade -f
bin/gpm version
# Verify version reports 2.0.2 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
