CVE-2026-72698 Overview
CVE-2026-72698 is an information disclosure vulnerability in Grav CMS versions before 2.0.16. The flaw exists in the sandboxed Twig rendering engine, which fails to filter system, site, and theme configuration arrays. Content editors with page-edit access can read sensitive configuration values by referencing them with dot notation inside Twig templates. This bypasses the config_denied_paths restrictions that Grav uses to hide secrets from low-privilege users. Exposed values include cache credentials and other configuration secrets stored server-side. The vulnerability is categorized under [CWE-200] Information Exposure.
Critical Impact
Authenticated content editors can extract server-side configuration secrets, including cache credentials, directly from Twig templates without administrative privileges.
Affected Products
- Grav CMS versions prior to 2.0.16
- Grav installations exposing the admin/editor interface to untrusted users
- Deployments relying on config_denied_paths to protect configuration secrets
Discovery Timeline
- 2026-08-25 - CVE-2026-72698 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-72698
Vulnerability Analysis
Grav CMS ships a Twig-based templating engine that content editors can use inside pages. To limit what editors can access, Grav runs those templates in a sandboxed context and enforces a config_denied_paths deny list. This list is meant to block access to sensitive configuration keys such as cache backend credentials.
The sandbox implementation fails to filter the top-level system, site, and theme configuration arrays. When an editor renders a Twig expression referencing these arrays with dot notation, Grav returns the raw configuration structure. The deny-list check does not traverse into arrays returned as whole objects, so any nested secret becomes readable.
The result is a privileged-user information disclosure: any account permitted to author page content can read configuration values reserved for administrators. Refer to the GitHub Security Advisory for the vendor description.
Root Cause
The root cause is incomplete input filtering in the Twig sandbox. Grav validates individual dotted paths against config_denied_paths but does not recursively sanitize arrays returned by top-level configuration accessors. Returning the parent array bypasses the per-path deny list entirely.
Attack Vector
Exploitation requires an authenticated account with page-content edit permissions. The attacker creates or edits a page and inserts a Twig expression that references system, site, or theme via dot notation. When Grav renders the page, the sandbox returns the raw configuration array, exposing values such as cache credentials, API keys, and other secrets stored in Grav configuration files. No user interaction beyond page rendering is needed, and the attack is delivered over the network via the standard admin interface.
No verified proof-of-concept code has been published. See the VulnCheck Security Advisory for additional context.
Detection Methods for CVE-2026-72698
Indicators of Compromise
- Page content or revisions containing Twig expressions that reference system., site., or theme. configuration paths
- Unexpected page renders that include cache backend hostnames, credentials, or API tokens in output
- Editor accounts creating or modifying pages that contain {{ system }}, {{ site }}, or {{ theme }} style constructs
- Access log entries showing content editors previewing pages immediately after inserting Twig configuration references
Detection Strategies
- Review Grav page files and stored revisions for Twig references to top-level configuration arrays
- Correlate editor authentication events with subsequent page edits and preview renders in web server logs
- Alert on rendered HTML output that matches patterns for cache DSNs, API keys, or password fields
- Baseline normal Twig usage per editor and flag deviations that reference configuration namespaces
Monitoring Recommendations
- Ingest Grav application logs, admin panel activity, and web server access logs into a centralized analytics platform
- Monitor for privilege changes and new editor accounts on Grav installations
- Track outbound connections from Grav hosts to cache and database backends for anomalous authentication failures that may follow credential theft
How to Mitigate CVE-2026-72698
Immediate Actions Required
- Upgrade Grav CMS to version 2.0.16 or later on all affected installations
- Rotate any secrets that were readable through system, site, or theme configuration, including cache credentials and API tokens
- Audit page content and revision history for Twig expressions referencing configuration arrays and remove them
- Review editor account membership and revoke access for accounts that are no longer required
Patch Information
The vulnerability is fixed in Grav CMS 2.0.16. The patch extends Twig sandbox filtering to cover the system, site, and theme configuration arrays so that config_denied_paths restrictions apply to nested values. Details are published in the GitHub Security Advisory GHSA-p597-crqc-m349.
Workarounds
- Restrict page-content edit permissions to fully trusted administrative users until patching is complete
- Remove or blank out sensitive values from system.yaml, site.yaml, and theme configuration where feasible, storing them in environment variables instead
- Disable the admin plugin on internet-facing instances that do not require editor access
# Upgrade Grav CMS to the patched release
bin/gpm selfupgrade
bin/gpm update
# Verify installed version is 2.0.16 or higher
bin/grav --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
