Twig Content Sandbox Escape in Grav by Getgrav

CVE-2026-100668

What is CVE-2026-100668?

Grav versions from 2.0.0 to 2.0.24 are vulnerable to a sandbox escape that allows users to access sensitive configuration data through the Twig templating engine. The vulnerability arises from the array filter being improperly registered without sufficient sandbox protection. This allows a user to exploit page content to execute Twig commands, exposing private service values such as plugin credentials and sensitive configuration parameters to anonymous visitors. This critical flaw compromises the integrity of the application's security framework, making it imperative for users to upgrade to Grav version 2.0.25 or later to mitigate these risks.

References