https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T22:43:00.048217+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-72698 fkie_cve-2026-72698 2026-10-03T22:43:00.095189+00:00

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

 https://vulnerability.circl.lu/vuln/ghsa-mw85-cjh9-8hp7 Withdrawn: GHSA-mw85-cjh9-8hp7 — Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never… 2026-10-03T22:43:00.095638+00:00

Withdrawn by the publisher.

Affected: Packagist: getgrav/grav

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p597-crqc-m349. This link is maintained to preserve external references.

### Original Description Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.