Medium severity6.5NVD Advisory· Published Aug 25, 2026· Updated Aug 31, 2026

CVE-2026-72698

Description

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
getgrav/gravPackagist	< 2.0.16	2.0.16

Affected products

Grav CMS/Gravllm-fuzzy
Range: <2.0.16

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p597-crqc-m349ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-72698ghsaADVISORY
github.com/getgrav/grav/security/advisories/GHSA-p597-crqc-m349nvdWEB
www.vulncheck.com/advisories/grav-cms-before-information-disclosure-via-twig-sandbox-bypassnvdWEB

News mentions

Grav CMS: Six Vulnerabilities Disclosed, Including Twig Sandbox Escapes and Secret Leaks
Vypr Intelligence · Aug 25, 2026

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000