CVE-2026-72698: Exposure of Sensitive Information to an Unauthorized Actor in getgrav grav

In Grav CMS, the Twig template engine's sandboxed rendering process replaces the 'config' variable with a filtered facade to prevent secret exfiltration. However, the raw 'system', 'site', and 'theme' configuration arrays are also passed into the sandboxed environment unfiltered. Twig's sandbox security policy does not restrict access to array keys, only to object methods and properties, so sensitive data nested in these arrays can be accessed directly in sandboxed page content renders. This allows an attacker with page content edit permissions to read sensitive configuration values, such as cache Redis passwords, even when the documented 'config' variable is empty in sandboxed renders. The vulnerability affects Grav CMS versions before 2.0.16.

An attacker with the ability to edit page content or inject Twig code in Grav CMS can access sensitive configuration information including secrets such as Redis cache passwords. This exposure occurs even when sandboxed rendering is enabled and the 'config' variable is restricted. The vulnerability can lead to unauthorized disclosure of sensitive data, potentially facilitating further attacks or system compromise. The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required beyond page edit access, and high confidentiality impact.

A fix is available in Grav CMS version 2.0.16 that addresses this issue by properly filtering or removing the raw 'system', 'site', and 'theme' arrays from the sandboxed Twig render variables. Users should upgrade to version 2.0.16 or later to remediate this vulnerability. Until upgraded, restrict page content editing permissions to trusted users only to reduce risk. No other mitigations are documented or effective because the vulnerability stems from the core template sandbox implementation.