CVE-2026-61450 describes a vulnerability in Grav CMS prior to version 2.0.2 where the Twig sandbox intended to restrict access to configuration data is bypassed. Although the 'config' variable is replaced with a redacted facade and certain methods are removed from the allowlist, the underlying configuration container remains accessible through the allow-listed grav.offsetGet('config') method. This returns the real Config object, which can then be serialized by allow-listed object-dumping filters such as json_encode, print_r, and yaml_encode without sandbox restrictions. This exposes the entire configuration tree, including sensitive plugin secrets like SMTP credentials, API keys, and database credentials. The issue represents an incomplete fix for a previous advisory (GHSA-j274-39qw-32c9).

An attacker with permissions to author pages or write to user/pages can exfiltrate sensitive configuration secrets from the Grav CMS installation. This includes SMTP credentials, API keys, and plugin database credentials, potentially leading to further compromise of the system or connected services. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity with network attack vector, low attack complexity, and no privileges required beyond page authoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict page authoring permissions to trusted users only and monitor for suspicious activity related to configuration data access. Avoid exposing sensitive configuration data via object-dumping filters in Twig templates.