Vulnerability · Published Jul 11, 2026 · Assigned by VulnCheck

CVE-2026-61454Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

Medium 5.3

In plain English

A medium-severity information exposure in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.4

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-pfjq-chp8-3vgh) vendor-advisory
VulnCheck Advisory: Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ third-party-advisory