CVE-2026-61450: Grav Twig Sandbox Bypass Exposes Configuration Secrets

Technical summary

CVE-2026-61450 is a Twig sandbox bypass in Grav's template rendering layer. The vulnerability stems from an incomplete implementation of the sandbox security model. Although the Grav developers replaced the 'config' variable with a redacted facade and removed Config::get and Config::toArray from the method allowlist, the underlying container remains accessible via the allow-listed grav.offsetGet('config') call. This call returns the unredacted Config object. Subsequently, allow-listed object-serialization filters—json_encode, print_r, and yaml_encode—serialize that Config object at the PHP object level rather than through the sandbox's method gate, bypassing sandbox restrictions and exposing the full configuration tree. CWE-94 (Code Injection) is the primary classification, though this manifests as template-level code injection enabling information disclosure.

Business impact

An authenticated page author can extract secrets from the Grav configuration without direct file system access. In multi-tenant or shared-hosting environments, this is especially critical: a low-privileged user with page-editing rights can harvest SMTP credentials, third-party API keys, and database connection strings. These credentials can then be used for lateral movement, credential stuffing, or unauthorized access to external services. The confidentiality impact is high, though integrity and availability of the Grav instance itself remain unaffected.

Affected systems

Grav versions before 2.0.2 are affected. Any Grav installation where untrusted users hold the admin.pages role (page creation/editing permission) or can write directly to the user/pages directory is at risk. This includes Grav sites with multiple content contributors, community-driven wikis, or hosted Grav environments that offer page-editing as a service.

Exploitability

Exploitability is straightforward for anyone with page-authoring permissions. No special tooling is required—the attack is executed through standard Twig template syntax. An attacker could embed the payload in a page body or a reusable Twig component, and the malicious code executes at page render time. The barrier to entry is low: the attacker need only understand Twig syntax and have valid credentials. However, the vulnerability requires authentication; unauthenticated remote exploitation is not possible.

Remediation

Upgrade to Grav 2.0.2 or later. This version fully addresses the sandbox bypass by preventing access to the raw config object via the container's offsetGet method and ensuring that object serialization respects sandbox restrictions. After upgrading, review access logs for any suspicious page creation or modification activity, and rotate secrets (SMTP passwords, API keys, database credentials) that were exposed during the window of vulnerability.

Patch guidance

Administrators should prioritize patching to Grav 2.0.2 or newer. The patch corrects the incomplete sandbox fix from the previous disclosure (GHSA-j274-39qw-32c9) by closing the remaining attack surface. Before patching, audit who holds page-editing privileges and consider temporarily restricting permissions if the vulnerability window was lengthy. After patching, test any custom Twig templates or plugins to ensure they do not rely on undocumented access patterns that may have been revoked.

Detection guidance

Monitor Grav server logs for page creation and modification events, particularly by low-privileged users. Look for pages containing Twig code using json_encode(), print_r(), or yaml_encode() on the grav variable or its offsetGet('config') result. Search the database or file system for pages recently modified that include suspicious Twig filters applied to config-related variables. Network-level detection is difficult unless the exfiltrated secrets are used in subsequent outbound connections; focus on application-level anomalies.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), this vulnerability merits rapid patching due to the nature of the secrets exposed. SMTP and API credentials directly enable lateral movement and supply-chain attacks. In environments with strict privilege separation or multi-tenancy, this is a critical integrity risk. The incomplete prior patch suggests vendor confidence may be limited, making timely upgrade prudent to avoid further disclosure or variant bypasses.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N score of 6.5 reflects high confidentiality impact but requires prior authentication (PR:L). The attack vector is network-accessible and requires no user interaction, but the prerequisite—valid page-editing credentials—limits the pool of potential attackers. The unchanged impact scope (S:U) means the vulnerability does not cross privilege boundaries in the Grav system itself, yet the data exposed can enable escalation outside Grav.

Frequently asked questions