Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-72698Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Medium 6.5

In plain English

A medium-severity information exposure in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	2.0.16	GHSA-p597-crqc-m349

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.16

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-p597-crqc-m349) vendor-advisory
VulnCheck Advisory: Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass third-party-advisory