Information Disclosure Vulnerability in Grav by Getgrav
CVE-2026-114657

6.9MEDIUM

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114657?

Grav versions prior to 2.2.5 experience an information disclosure flaw that permits page authors to improperly expose HTTP Basic authentication credentials. Exploiting this vulnerability involves the use of Twig templates, where authors can render the request URI. This improperly exposes the PHP_AUTH_USER and PHP_AUTH_PW variables through embedded content, enabling potential unauthorized capture of sensitive administrator credentials to an external server.

Affected Version(s)

grav 2.0.0 < 2.2.5

grav 2.2.5

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-2.0.0-before-2....
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.