Description

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered without the needs_is_sandboxed guard that print_r, vardump, json_encode, yaml_encode and string carry, and its implementation calls toArray() — or falls back to an (array) cast — without consulting the sandbox method allowlist. Because the `grav` Twig global is the raw Pimple-based dependency injection container, a user who can author Twig in page content can evaluate `grav|array` to read the container's private $values array, including the un-redacted Config service; a second array cast returns the entire configuration tree, disclosing plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs and the security.* subtree that the sandbox's redaction is meant to hide. Because the payload is stored in page content, the disclosed configuration is rendered to anonymous visitors. Grav 1.7 is not affected as it has no Twig content sandbox. Fixed in Grav 2.0.25.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:50.273Z",
  "pubdate": "2026-09-26T14:16:50.273Z",
  "executiveSummary": "Grav versions 2.0.0 through 2.0.24 are susceptible to a critical Twig sandbox escape vulnerability. This flaw arises from an improper allowlist configuration of the 'array' filter within the Twig environment, which fails to enforce necessary sandboxing constraints. By leveraging this vulnerability, an attacker capable of authoring Twig content within pages can bypass established security protections to access the application's internal dependency injection container.\nThe primary impact is the unauthorized disclosure of the entire Grav configuration tree, which includes sensitive information such as SMTP and OAuth credentials, Redis passwords, proxy URLs, and private security keys. Because the malicious payload is stored directly in page content, the exfiltrated sensitive data is rendered to any visitor accessing the affected page, leading to full site configuration exposure. This vulnerability presents a high risk to data confidentiality and infrastructure security. Exploitation does not require elevated privileges beyond the ability to contribute content, making it particularly dangerous in collaborative environments or setups where untrusted users can submit page content.",
  "technicalDetails": "The vulnerability originates from the incorrect registration of the 'array' filter in the Grav 2.0.x Twig sandbox environment. While security-sensitive filters like print_r, vardump, json_encode, yaml_encode, and string are correctly implemented with a needs_is_sandboxed guard, the 'array' filter omits this critical safety check. Consequently, when the filter is invoked, its implementation executes toArray() or performs an (array) cast on the provided object without verifying the request against the sandbox method allowlist.\nThe exploit leverages the 'grav' Twig global, which is an instance of a Pimple-based dependency injection container. Under normal sandboxed conditions, access to the internal state of this container is restricted. However, by invoking the 'array' filter via the expression 'grav|array', the attacker forces the container to disclose its private $values array. A subsequent array cast on this output circumvents the sandbox's redaction mechanisms, which are designed to obfuscate sensitive fields within the security.* configuration subtree.\nThe attack flow proceeds as follows: First, an attacker injects a malicious Twig payload into a page via the content editor. Second, when the page is requested, the Grav Twig engine parses the content and processes the 'grav|array' filter. Because the filter bypasses the sandbox guard, the application interprets the raw dependency injection container as a standard object. Third, the resulting array containing the application's global configuration is serialized or rendered into the page output. Finally, the server serves the page to the victim or anonymous user, displaying the plain-text configuration data, including API keys, database credentials, and service passwords.\nThis vulnerability is restricted to Grav 2.0.0 through 2.0.24; Grav 1.7 is immune as it does not implement the Twig content sandbox feature. The issue is fundamentally a breakdown in the secure boundary between the Twig template engine and the application's internal service container, allowing an attacker to manipulate the scope of the evaluation to reveal protected system properties."
}