Grav CMS versions 2.0.0 through 2.0.24 and 1.7.x (when content Twig is enabled) allow page-write users to execute Twig templates that include a get_cookie() function. This function returns cookies from the current request, including session cookies, which are read server-side and thus not protected by HttpOnly, Secure, or SameSite flags. The rendered output is cached keyed only by page identity and configuration checksum, without differentiating by user session or request. Consequently, a page authored by a page-write user can capture the session cookie of an administrator who views the page next. The cached output then serves this session cookie to unauthenticated visitors, enabling them to impersonate the administrator by replaying the cookie. Since version 2.0.19, Twig content processing is enabled by default on pages without frontmatter, increasing exposure. The vulnerability is resolved in Grav 2.0.25. Version 1.7.x is not patched for this issue.

An attacker with page-write permission can embed malicious Twig code to capture administrator session cookies. This leads to exposure of sensitive session identifiers to unauthenticated visitors, allowing session hijacking and unauthorized administrative access. The vulnerability compromises confidentiality and integrity of administrator sessions. It affects all Grav CMS installations running affected versions with content Twig enabled, potentially allowing privilege escalation and unauthorized control over the CMS.

Upgrade Grav CMS to version 2.0.25 or later, where this vulnerability is fixed. For versions 1.7.x, no official backport is available, so consider disabling content Twig processing or restricting page-write permissions until an alternative mitigation is implemented. Since the vulnerability arises from caching rendered Twig output containing sensitive cookies, disabling or restricting Twig content processing can reduce risk. No other vendor advisories indicate additional mitigations or that the issue is already mitigated.