Skip to content
Threat Feed
Subscribe

Product

Grav (2.0.0-Rc.1 Through 2.0.21)

1 brief RSS
high advisory

Grav CMS Twig Sandbox Bypass via Configuration Exposure

CVE-2026-92917 allows an authenticated user with page-edit privileges in Grav CMS 2.0.0-rc.1 through 2.0.21 to bypass Twig sandboxing and exfiltrate the full application configuration, including API keys and credentials.

Grav +1 cms web-application security-misconfiguration information-disclosure
3t 1c updated