CVE-2026-44738

Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9	Exploit Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:getgrav:grav::::::::
	cpe:2.3:a:getgrav:grav:2.0.0:beta1::::::
	cpe:2.3:a:getgrav:grav:2.0.0:beta2::::::
	cpe:2.3:a:getgrav:grav:2.0.0:beta3::::::
	cpe:2.3:a:getgrav:grav:2.0.0:beta4::::::
	cpe:2.3:a:getgrav:grav:2.0.0:rc1::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Grav es una plataforma web basada en archivos. Antes de la versión 2.0.0-rc.2, la lista de permitidos del sandbox de Twig permite a cualquier usuario con el rol admin.pages llamar a config.toArray() desde el cuerpo de una página, volcando la configuración completa del sitio fusionado - incluyendo todos los secretos de los plugins (contraseñas SMTP, claves AWS, secretos de cliente OAuth, tokens de API) - en el HTML renderizado. No se requieren privilegios de administrador. Esta vulnerabilidad está corregida en la versión 2.0.0-rc.2.

Information

Published : 2026-05-11 17:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-44738

Mitre link : CVE-2026-44738

CVE.ORG link : CVE-2026-44738

JSON object : View

Products Affected

getgrav

grav

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2026-44738", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44738", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T18:04:51.140656Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "< 2.0.0-rc.2"}]}]}], "published": "2026-05-11T17:16:34.747", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration \u2014 including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) \u2014 into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2."}, {"lang": "es", "value": "Grav es una plataforma web basada en archivos. Antes de la versi\u00f3n 2.0.0-rc.2, la lista de permitidos del sandbox de Twig permite a cualquier usuario con el rol admin.pages llamar a config.toArray() desde el cuerpo de una p\u00e1gina, volcando la configuraci\u00f3n completa del sitio fusionado - incluyendo todos los secretos de los plugins (contrase\u00f1as SMTP, claves AWS, secretos de cliente OAuth, tokens de API) - en el HTML renderizado. No se requieren privilegios de administrador. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.0.0-rc.2."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "064CDB77-36FA-4294-9397-0D6FC8E67F1F", "versionEndExcluding": "2.0.0"}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ABB323F-20AF-40F3-BCD9-262644D242A1"}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23F8F687-3238-4CC0-AAC0-8D73DD13EB57"}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D2DD669-63FD-44AF-ABA7-5998216D81B0"}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0439ACB4-C5F0-4C78-B62D-8A7CCCA95943"}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8DFF41E-3A2E-4975-8417-6157E923D749"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}