CVE-2026-114657 Details

An information disclosure vulnerability has been identified in Grav versions 2.0.0 prior to 2.2.5. This vulnerability allows page authors to capture visitors' HTTP Basic authentication credentials by embedding them in Twig page content. When the page is viewed, the credentials are exfiltrated to an external host. The issue arises because the request URI object includes PHP_AUTH_USER and PHP_AUTH_PW, which can be accessed and manipulated by authors through Twig. This vulnerability specifically affects sites using HTTP Basic authentication, where each visitor has unique credentials.

Users can upgrade to Grav version 2.2.5 or later, where this vulnerability has been fixed. After the update, the request URI no longer contains Basic authentication credentials, and any code that requires these credentials should retrieve them directly from the server variables.