Medium severity6.5NVD Advisory· Published Aug 25, 2026

CVE-2026-72698

Description

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grav CMS/Gravllm-fuzzy
Range: <2.0.16

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-p597-crqc-m349nvd
www.vulncheck.com/advisories/grav-cms-before-information-disclosure-via-twig-sandbox-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000