CVE-2026-72698CWE-200information-disclosure

CVE-2026-72698

Medium · published August 25, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00409 · 34.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-25T06:16Z
References (2)
https://github.com/getgrav/grav/security/advisories/GHSA-p597-crqc-m349 · [email protected]https://www.vulncheck.com/advisories/grav-cms-before-information-disclosure-via-twig-sandbox-bypass · [email protected]
EPSS history
Timeline
  • 26 AUG 08:25Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:30Z
    Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
    cvelistv5