Grav CMS versions 2.0.0 through 2.0.24 (and 1.7.x with content Twig enabled) render user-authored page content through a Twig sandbox that allowlists the get_cookie() function. This function returns any cookie sent with the current request, including session cookies, which are read server-side bypassing HttpOnly, Secure, and SameSite protections. The rendered output is cached keyed only by page identity and configuration checksum, without session or user context. Consequently, a page published by a user with page-write permission can capture the session cookie of an administrator who views the page next. This cached output is then served to unauthenticated visitors, who can replay the captured cookie to authenticate as that administrator. Since version 2.0.19, content Twig processing is enabled by default on all pages without frontmatter or operator action. The vulnerability is fixed in Grav version 2.0.25; the 1.7.x branch is outside the backport scope.

An attacker with page-write permission can craft page content that captures the session cookie of an administrator viewing the page. This session cookie is cached and subsequently served to unauthenticated visitors, enabling them to replay the cookie and gain administrator-level access. This results in full confidentiality, integrity, and availability compromise of the Grav CMS instance. The vulnerability has a high CVSS score of 8.0, reflecting its potential for remote exploitation with low attack complexity and high impact.

A fixed version, Grav 2.0.25, is available and should be applied to remediate this vulnerability. The 1.7.x branch is not patched for this issue. Until upgrading, avoid enabling content Twig processing for user-authored pages or restrict page-write permissions to fully trusted users. Review and disable the allowlisted get_cookie() function in Twig sandbox if possible. No other vendor advisories indicate alternative mitigations.