Grav CMS versions before 2.0.16 have a vulnerability where system, site, and theme configuration arrays are not filtered in sandboxed Twig template renders. This allows attackers with page-content edit permissions to read sensitive configuration data, including secrets like cache credentials, by bypassing config_denied_paths restrictions using dot notation in Twig templates.