Skip to content
Threat Feed
Subscribe

Product

Grav (< 2.0.25)

1 brief RSS
high threat

Grav CMS Session Hijacking via Twig Sandbox Injection

Grav CMS versions 1.7.x and 2.0.0 through 2.0.24 are vulnerable to session hijacking due to an improperly restricted get_cookie() function within the Twig rendering engine.

exploited Grav +2 web-application security-misconfiguration cve-2026-100669
3t 1c