Information Disclosure in Grav Affected by Unsafe Page Configuration

CVE-2026-112781

What is CVE-2026-112781?

Grav versions prior to 2.2.2 contain an information disclosure flaw where users with page-editing privileges can exploit the config-*@ directives in frontmatter forms. By circumventing the Twig sandbox restrictions, attackers gain access to sensitive information such as security salts, plugin credentials, and Redis passwords, potentially compromising the integrity and confidentiality of the application. This vulnerability underscores the importance of properly securing configuration settings and validating user privileges.

References