Grav CMS Information Disclosure via Twig Sandbox Bypass in Page Frontmatter
Page editors in Grav CMS versions before 2.2.2 can expose sensitive configuration data to all visitors through a frontmatter directive bypass.
Key points
- CVE-2026-112781 allows page editors to read protected configuration files.
- The flaw bypasses Twig sandbox redaction for config_denied_paths.
- Sensitive data like security salts and Redis passwords are exposed.
Grav CMS contains an information disclosure vulnerability that permits page editors to access protected configuration details. This flaw, tracked as CVE-2026-112781, affects versions prior to 2.2.2. Attackers with page-edit permissions can manipulate page frontmatter forms to reveal sensitive data to any site visitor. The issue stems from a failure in the Twig sandbox security controls.
Root cause
The vulnerability arises because the Twig sandbox configuration for `config_denied_paths` can be circumvented. According to the NVD record, page editors can add specific `config-*@` directives to page frontmatter forms. This action allows them to read configuration values that should remain hidden. The weakness is classified as CWE-200, indicating an improper information exposure mechanism within the application logic.
Attack path
An attacker needs only page-edit permission to exploit this issue. They insert `config-*@` directives into the frontmatter of a page form. This bypasses the intended redaction rules of the Twig sandbox. Once executed, the system exposes protected configuration details to all visitors viewing the page. The exposed data can include critical credentials and security parameters.
Affected versions
- Grav CMS version 2.0.0
- Grav CMS versions between 2.0.0 and 2.2.2
- Any Grav installation running software before version 2.2.2
Mitigation
- Upgrade Grav CMS to version 2.2.2 or later immediately.
- Restrict page-edit permissions to trusted administrators only.
- Audit current page frontmatter for unusual `config-*@` directives.
- Monitor access logs for unexpected configuration data exposure.
Signals worth monitoring
Teams usually detect this activity by reviewing web server access logs for unusual requests to configuration endpoints. Check whether page edits are resulting in responses containing sensitive strings like salts or passwords. Monitor for new frontmatter entries added by users with limited permissions. Look for alerts triggered by data leakage detection tools. Contain the issue by revoking edit rights for suspicious accounts and isolating affected pages until patches are applied.
What to do and how to stay safe: Grav CMS
- Inventory all Grav CMS instances and check their current version numbers.
- Review user access controls to ensure only necessary staff have page-edit rights.
- Scan recent page updates for the presence of config directive patterns.
- Prepare to deploy the vendor update once it is available for your environment.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-112781?
It is an information disclosure vulnerability in Grav CMS that allows page editors to expose protected configuration data.
Which versions of Grav are affected?
All versions of Grav from 2.0.0 up to, but not including, version 2.2.2 are affected.
How is the vulnerability exploited?
Attackers add config-*@ directives to page frontmatter forms to bypass Twig sandbox redaction.
