Description

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T16:18:17.003Z",
  "pubdate": "2026-08-19T16:18:17.003Z",
  "executiveSummary": "Grav prior to version 2.0.2 is affected by an information disclosure vulnerability within the Grav Twig content sandbox. The vulnerability allows authenticated users with page-author permissions to bypass security policies and access sensitive system configuration secrets, including SMTP credentials, API keys, and plugin database credentials. The root cause stems from the Twig content sandbox permitting grav.offsetGet('config') to return the raw configuration object combined with the ability of serialization filters such as json_encode, print_r, yaml_encode, and string filters to process this object without passing through the required GravSecurityPolicy::checkMethodAllowed validation checks. The risk implication is significant as it permits lower-privileged users to exfiltrate critical operational secrets and sensitive backend credentials. Exploitation requires page-author permissions and the ability to render sandboxed Twig content within the platform. Remediation is achieved by upgrading the Grav platform to version 2.0.2 or later, which properly addresses the policy enforcement bypass during object serialization within the template environment.",
  "technicalDetails": "The vulnerability resides within the Grav Twig content sandbox mechanism, specifically in how it handles object retrieval and serialization filters prior to version 2.0.2. The vulnerable component involves the integration between Twig template evaluation and the GravSecurityPolicy enforcement engine. The root cause is an authorization bypass condition where the grav.offsetGet('config') method successfully retrieves and returns the raw configuration object to the template execution context.\nDuring standard template rendering operations, access to sensitive methods and properties is normally restricted and filtered through GravSecurityPolicy::checkMethodAllowed to ensure that unauthorized users cannot access restricted backend data. However, the parser fails to enforce these security policy checks when specific serialization and formatting filters—namely json_encode, print_r, yaml_encode, and general string conversion filters—are applied directly to the raw configuration object returned by the offset retrieval function.\nThe attack flow proceeds as follows: an attacker with page-author privileges crafts a malicious payload within a sandboxed Twig template. This payload invokes grav.offsetGet('config') to acquire the global configuration repository. Instead of triggering a policy violation or returning a sanitized subset of data, the template engine passes the raw configuration object directly into one of the vulnerable serialization filters, such as json_encode or yaml_encode.\nBecause the serialization filters bypass GravSecurityPolicy::checkMethodAllowed, the internal structure of the configuration object is fully serialized and rendered directly into the HTTP response. The post-exploitation impact includes the total exposure of plugins.* configuration secrets. An attacker can extract sensitive credentials such as SMTP authentication details, third-party API keys, and internal plugin database credentials. Authentication and privilege requirements are limited to page-author permissions within the Grav administrative or authoring interface, and the attack vector is exploitable wherever sandboxed Twig template rendering is processed by the application."
}