CVE-2026-44738

Published: May 11, 2026Modified: Jun 17, 2026

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.1 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.

Affected (6)

Products: Getgrav: Grav

Getgrav

1 product

Grav

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Getgrav Grav	Before 2.0.0
Getgrav Grav	Version 2.0.0 beta1
Getgrav Grav	Version 2.0.0 beta2
Getgrav Grav	Version 2.0.0 beta3
Getgrav Grav	Version 2.0.0 beta4
Getgrav Grav	Version 2.0.0 rc1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.