{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/gantry/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gantry:gantry_5_framework:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110889"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gantry 5 Framework (\u003c= 5.6.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Gantry"],"content_html":"\u003cp\u003eThe Gantry 5 Framework, used in various content management systems, contains a vulnerability identified as CVE-2026-110889. This flaw involves the generation of error messages that include sensitive embedded information. By triggering specific application errors, an unauthenticated attacker can force the framework to return detailed system or configuration data that would otherwise remain hidden. This issue affects all versions of the Gantry 5 Framework up to and including version 5.6.4. The vulnerability is classified with a CVSS v3.1 base score of 7.5, reflecting its potential for facilitating further exploitation by providing attackers with reconnaissance data about the underlying environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this vulnerability allows unauthorized users to gain access to sensitive configuration information or internal system data. This intelligence can be used to tailor subsequent attacks against the host environment. The impact is primarily limited to information disclosure, though it significantly lowers the barrier for adversaries to map the application architecture and identify additional attack surfaces.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Gantry 5 Framework to a version beyond 5.6.4, once an official patch is provided by the vendor.\u003c/li\u003e\n\u003cli\u003eReview web server error logs for recurrent application errors that may indicate an attacker is probing for sensitive information via error triggers.\u003c/li\u003e\n\u003cli\u003eConfigure web server settings to disable the display of verbose error messages or stack traces to end-users to mitigate the impact of this vulnerability until a patch can be applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T21:53:31Z","date_published":"2026-10-17T21:53:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gantry-info-disclosure/","summary":"The Gantry 5 Framework is vulnerable to an information disclosure flaw where improper error handling results in the generation of error messages containing sensitive data, allowing unauthorized retrieval.","title":"Information Disclosure Vulnerability in Gantry 5 Framework","url":"https://feed.craftedsignal.io/briefs/2026-10-gantry-info-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Gantry","version":"https://jsonfeed.org/version/1.1"}