{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav--2.0.15/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-75837"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav (\u003c= 2.0.12)","grav (\u003c= 2.0.14)","grav (\u003c= 2.0.15)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","cms","vulnerability","web-application-vulnerability","path-traversal","cve-2026-74907","twig","security-misconfiguration"],"_cs_type":"advisory","_cs_vendors":["getgrav"],"content_html":"\u003cp\u003eGrav version 2.0.12 and earlier contains a privilege escalation vulnerability within its Flex group management functionality. The core group blueprint file located at \u003ccode\u003esystem/blueprints/user/group.yaml\u003c/code\u003e omits a mandatory \u003ccode\u003esecurity@: admin.super\u003c/code\u003e guard on the group access field. In the Grav Flex architecture, the \u003ccode\u003esecurity@\u003c/code\u003e guard is the primary mechanism that flags fields for exclusion during the data save path for non-super users.\u003c/p\u003e\n\u003cp\u003eBecause this guard is missing from the group blueprint, a delegated administrator holding only \u003ccode\u003eadmin.users.update\u003c/code\u003e permissions can successfully submit a request to update a group's access map. By injecting \u003ccode\u003eadmin.super: true\u003c/code\u003e into the group's access configuration, the attacker effectively grants the 'super-admin' role to all members of that group. This escalation provides full administrative control over the application, including access to the scheduler, which can be leveraged for Remote Code Execution (RCE) via cron jobs, and potential Twig template evaluation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: The attacker authenticates as a user with \u003ccode\u003eadmin.users.update\u003c/code\u003e permissions, which is typically granted to delegated administrators responsible for user management.\u003c/li\u003e\n\u003cli\u003eDiscovery: The attacker identifies that they can modify group access configurations, as the application exposes groups at the \u003ccode\u003eadmin.users:crudl\u003c/code\u003e path, which the attacker has permission to update.\u003c/li\u003e\n\u003cli\u003eForm Submission: The attacker sends a \u003ccode\u003ePOST\u003c/code\u003e request to the \u003ccode\u003e/admin/accounts/groups/\u003c/code\u003e endpoint, embedding the malicious payload \u003ccode\u003eaccess[admin][super]=true\u003c/code\u003e within the group update data.\u003c/li\u003e\n\u003cli\u003eBlueprint Bypass: The system's \u003ccode\u003eBlueprint::dynamicSecurity\u003c/code\u003e check fails to flag the \u003ccode\u003eaccess\u003c/code\u003e field as restricted because the \u003ccode\u003egroup.yaml\u003c/code\u003e blueprint lacks the required \u003ccode\u003esecurity@: admin.super\u003c/code\u003e declaration.\u003c/li\u003e\n\u003cli\u003eValidation Bypass: The \u003ccode\u003eBlueprintSchema::filterArray\u003c/code\u003e and \u003ccode\u003eValidation::filterArray\u003c/code\u003e logic processes the payload and retains the restricted \u003ccode\u003eadmin.super\u003c/code\u003e key because the input is not marked for filtering.\u003c/li\u003e\n\u003cli\u003ePersistence: The application saves the unauthorized access configuration to \u003ccode\u003euser://config/groups.yaml\u003c/code\u003e via the \u003ccode\u003eFlexObject::update()\u003c/code\u003e path without further authorization checks.\u003c/li\u003e\n\u003cli\u003ePrivilege Escalation: Upon the next request, the \u003ccode\u003eUserGroupObject::authorize('admin.super')\u003c/code\u003e method evaluates the modified group ACL and returns true, promoting the attacker to full super-admin status.\u003c/li\u003e\n\u003cli\u003eImpact: The attacker utilizes the escalated super-admin privileges to access the administrative dashboard, modify scheduler tasks, or execute malicious Twig templates to achieve RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control (C:H/I:H/A:H) over the Grav instance. The attacker gains the ability to manage all users, execute arbitrary code via the scheduler, and modify system files. This vulnerability affects all Grav versions up to and including 2.0.12.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and IT operations teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Grav to version 2.0.14 or later immediately to incorporate the required blueprint security guards.\u003c/li\u003e\n\u003cli\u003eAudit existing \u003ccode\u003euser://config/groups.yaml\u003c/code\u003e files for any unauthorized \u003ccode\u003eadmin.super: true\u003c/code\u003e entries in group access maps.\u003c/li\u003e\n\u003cli\u003eReview all users currently holding the \u003ccode\u003eadmin.users\u003c/code\u003e role to identify accounts that should not have the ability to modify group permissions.\u003c/li\u003e\n\u003cli\u003eUse server-side web application logs to monitor for unauthorized \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/admin/accounts/groups/\u003c/code\u003e originating from non-super-admin accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T01:12:31Z","date_published":"2026-09-18T01:10:51Z","id":"https://feed.craftedsignal.io/briefs/2026-09-grav-privilege-escalation/","summary":"A missing 'security@' guard in Grav's group blueprint allows an 'admin.users' operator to escalate privileges to 'admin.super' by modifying group access configurations.","title":"Grav Privilege Escalation via Group Blueprint ACL Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-grav-privilege-escalation/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-92917"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav (2.0.0-rc.1 through 2.0.21)","Grav (\u003c= 2.0.15)"],"_cs_severities":["high"],"_cs_tags":["cms","web-application","security-misconfiguration","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eGrav CMS, a popular flat-file content management system, contains a vulnerability (CVE-2026-92917) within its Twig content sandbox implementation in versions 2.0.0-rc.1 through 2.0.21. The vulnerability stems from an incorrect implementation of the sandbox security check in \u003ccode\u003eGravExtension::assertSandboxDumpSafe()\u003c/code\u003e. Instead of checking if specific filters like \u003ccode\u003eprint_r\u003c/code\u003e, \u003ccode\u003ejson_encode\u003c/code\u003e, or \u003ccode\u003eyaml_encode\u003c/code\u003e are sandboxed relative to the source, the extension queries the global sandbox flag, which remains permanently disabled in Grav. Consequently, the safety guards intended to restrict data dumping fail. An authenticated attacker with page-edit permissions can leverage this by embedding Twig template code within a page. When rendered, the application processes the request, ignores the sandbox restrictions, and outputs the entire internal \u003ccode\u003eConfig\u003c/code\u003e object, including sensitive secrets stored in private properties that are normally redacted. This exposure allows attackers to harvest SMTP credentials, API tokens, webhook secrets, and cache backend passwords. The vulnerability is resolved in Grav version 2.0.22, where the filters are correctly registered with Twig’s \u003ccode\u003eneeds_is_sandboxed\u003c/code\u003e flag.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to gain access to sensitive application configuration data. This includes administrative secrets required for third-party integrations and backend services. Exposure of these credentials can facilitate further compromise of internal infrastructure, external services, and data exfiltration, significantly increasing the attacker's footprint within the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Grav CMS to version 2.0.22 or later immediately to patch CVE-2026-92917.\u003c/li\u003e\n\u003cli\u003eAudit web application logs for administrative users accessing Twig-related rendering functions, specifically looking for attempts to use \u003ccode\u003eprint_r\u003c/code\u003e, \u003ccode\u003evardump\u003c/code\u003e, or \u003ccode\u003ejson_encode\u003c/code\u003e filters within page content updates.\u003c/li\u003e\n\u003cli\u003eRevoke and rotate all secrets (SMTP, API tokens, webhooks) found in the Grav configuration if a compromise is suspected to have occurred between version 2.0.0-rc.1 and 2.0.22.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T01:12:38Z","date_published":"2026-09-17T13:57:24Z","id":"https://feed.craftedsignal.io/briefs/2026-09-grav-cms-sandbox-bypass/","summary":"CVE-2026-92917 allows an authenticated user with page-edit privileges in Grav CMS 2.0.0-rc.1 through 2.0.21 to bypass Twig sandboxing and exfiltrate the full application configuration, including API keys and credentials.","title":"Grav CMS Twig Sandbox Bypass via Configuration Exposure","url":"https://feed.craftedsignal.io/briefs/2026-09-grav-cms-sandbox-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav (\u003c= 2.0.15)","version":"https://jsonfeed.org/version/1.1"}