CVE-2026-110889: Generation of Error Message Containing Sensitive Information in Gantry Gantry 5 Framework

The vulnerability identified as CVE-2026-110889 in the Gantry 5 Framework involves the generation of error messages that expose sensitive information embedded within the system. This exposure can be leveraged by an attacker to retrieve confidential data. The issue affects all versions of Gantry 5 Framework up to version 5.6.4 inclusive. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and a high impact on confidentiality. There is no indication of integrity or availability impact. No known exploits are reported in the wild, and no patch or remediation information is provided in the available data.

An attacker can remotely trigger error messages that reveal sensitive embedded information within the Gantry 5 Framework, potentially leading to unauthorized disclosure of confidential data. This confidentiality breach does not require any privileges or user interaction, making it a significant risk. There is no evidence of impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by controlling access to error messages and sensitive system information. Avoid displaying detailed error messages in production environments.