CVE-2026-61450 Details
Description
Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method allowlist, the raw container remains accessible via the allow-listed grav.offsetGet('config'), which returns the real Config object. Allow-listed object-dumping filters (json_encode, print_r, yaml_encode) then serialize that object at the PHP level without invoking the sandbox method gate, exposing the full config tree including plugin secrets such as SMTP credentials, API keys, and plugin DB credentials. This is an incomplete fix for GHSA-j274-39qw-32c9.
A vulnerability in Grav versions prior to 2.0.2 allows page authors to bypass the Twig sandbox and exfiltrate configuration secrets. The issue arises because the sandbox replaces the 'config' variable with a redacted version and removes certain methods from the allowlist. However, the raw container can still be accessed through the allow-listed 'grav.offsetGet('config')', which returns the actual Config object. Exploitation involves using allow-listed object-dumping filters to serialize the Config object, bypassing the sandbox's method restrictions and exposing sensitive information such as plugin SMTP credentials, API keys, and database credentials.
Users can update to Grav version 2.0.2, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-before-config-exfiltration-via-offsetget-filter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 0, < 2.0.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |