Grav CMS: Six Vulnerabilities Disclosed, Including Twig Sandbox Escapes and Secret Leaks
Key findings • Six vulnerabilities in Grav CMS fixed in version 2.0.16, disclosed on August 25, 2026. • High severity flaws allow access to sensitive system secrets and user credentials via T…
Key findings
- Six vulnerabilities in Grav CMS fixed in version 2.0.16, disclosed on August 25, 2026.
- High severity flaws allow access to sensitive system secrets and user credentials via Twig sandbox escapes.
- Medium severity issues include origin validation bypass and local file overwrite via symlinks.
- Low severity timing vulnerability in nonce verification could allow recovery of CSRF tokens.
- Users with page-edit or content-edit permissions are most at risk from configuration leaks.
On August 25, 2026, a batch of six vulnerabilities was disclosed for Grav CMS, all fixed in version 2.0.16. These flaws, ranging in severity from Low to High, primarily stem from insufficient sanitization and validation within the Twig templating engine and core system functions. The most critical issues could allow attackers with content editing privileges to access sensitive system secrets and user credentials.
Twig Sandbox Escapes and Configuration Leaks
Several vulnerabilities center on weaknesses in the Twig sandbox configuration, allowing attackers with page-edit permissions to bypass intended restrictions.
CVE-2026-76846, a High severity flaw, arises from an incomplete default denylist in the Twig sandbox. This allows attackers to use config.get() or config.toArray() in Twig templates to retrieve sensitive system configuration values, such as Redis passwords.
Similarly, CVE-2026-76839 (Medium severity) exploits allow-listed offsetGet() and offsetExists() methods in sandboxed Twig templates. These methods lack proper field filtering, enabling attackers to extract sensitive User fields, including hashed passwords and two-factor authentication secrets, which could then be used for offline cracking.
CVE-2026-72698 (Medium severity) also relates to configuration leaks. Grav CMS before 2.0.16 fails to adequately filter system, site, and theme configuration arrays within sandboxed Twig renders. Content editors with page-content edit access can exploit this by using dot notation in Twig to read raw configuration arrays, potentially exposing cache credentials and other secrets.
Origin Validation and Timing Vulnerabilities
Beyond Twig-related issues, other vulnerabilities impact core Grav CMS functionality.
CVE-2026-72702 (Medium severity) involves an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods. These methods validate the Referer header using an unanchored string prefix match, which can be bypassed by an attacker controlling a domain that starts with the victim's base URL.
CVE-2026-72701 (Low severity) is a timing vulnerability in Utils::verifyNonce(). The function uses a non-constant-time string comparison (===) instead of hash_equals() for CSRF nonce validation. This allows attackers to measure response timing differences and, through repeated requests, recover valid nonce values byte-by-byte.
Local File Overwrite via Symlink
A High severity vulnerability, CVE-2026-72696, exists in the Scheduler Job::createLockFile() method. This flaw allows local attackers to overwrite arbitrary files. By pre-creating symbolic links (symlinks) at predictable lock file paths within the world-writable temporary directory, attackers can trick the scheduler into writing to unintended files.
Response and Mitigation
All six vulnerabilities were addressed in Grav CMS version 2.0.16. Users are strongly advised to update to this version or later to mitigate these security risks. The disclosures highlight the importance of thoroughly validating inputs and ensuring robust security configurations, especially within templating engines and when handling sensitive user and system data. Maintaining updated software is crucial for protecting against such vulnerabilities.