CVE-2026-61450

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.2

Description A Twig sandbox bypass allows a page author, specifically any user with admin.pages permissions or those capable of writing to user/pages, to exfiltrate configuration secrets. While the sandbox attempts to redact the config variable and remove Config::get and toArray from the method allowlist, the actual Config object is still accessible through the allow-listed grav.offsetGet('config') method. By using allow-listed object-dumping filters such as json encode, print r, or yaml encode, an attacker can serialize the object at the PHP level, bypassing the sandbox method gate. This exposes the complete configuration tree, including sensitive data like SMTP credentials, API keys, and plugin database credentials.

Recommendations Update Grav to version 2.0.2 or later.