CVE-2026-61842

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.2

Description The Grav Twig content sandbox allows the use of grav.offsetGet('config') to return the raw configuration object. Additionally, it permits the use of json encode, print r, yaml encode, and string filters to serialize this object without passing through the GravSecurityPolicy::checkMethodAllowed() function. A user with page-author permissions can exploit this to render sandboxed content that exposes configuration secrets, such as SMTP credentials, API keys, and plugin database credentials.

Recommendations Update to version 2.0.2.