Timing Vulnerability in Grav CMS by Getgrav

CVE-2026-72701

What is CVE-2026-72701?

Grav CMS prior to version 2.0.16 contains a timing vulnerability within the nonce verification process in the Utils::verifyNonce() function. By implementing a non-constant-time string comparison using the === operator instead of the more secure hash_equals(), the system becomes susceptible to timing attacks. This allows malicious actors to exploit response timing differences to deduce valid nonce values one byte at a time through successive requests, thus undermining the intended strength of CSRF protection mechanisms.

References