File-based Web Platform Vulnerability in Grav by GetGrav
CVE-2026-44738

7.7HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
11 May 2026

What is CVE-2026-44738?

A vulnerability in the Grav open-source file-based web platform allows users with the admin.pages role to exploit the Twig sandbox allow-list. This oversight permits unauthorized access to execute config.toArray() within a page's content, exposing the entire merged site configuration. Sensitive information such as plugin secrets, including SMTP passwords, AWS keys, OAuth client secrets, and API tokens, may be revealed in the rendered HTML without requiring administrator rights. The vulnerability has been addressed in version 2.0.0-rc.2.

Affected Version(s)

grav < 2.0.0-rc.2

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.