Session Cookie Exposure in Grav Flat-file CMS

CVE-2026-100671

What is CVE-2026-100671?

Grav CMS versions 2.0.19 through 2.0.24, along with earlier versions where Twig content is enabled, contain a vulnerability that allows a user with page-write permission to execute code that may expose session cookies. This occurs as crafted page content is processed through a Twig sandbox that permits access to the get_cookie() function. The server-side read of cookies bypasses the usual security measures offered by HttpOnly, Secure, and SameSite attributes, enabling malicious users to capture the session ID of administrators upon viewing the compromised content. Consequently, this threat can lead to unauthorized access by impersonating admin users through stale cached content. The vulnerability has been addressed in Grav version 2.0.25.

References