CVE-2026-112781 in Grav
Summary
by MITRE • 10/19/2026
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The Grav content management system version 2.0.0 through 2.2.1 contains a critical information disclosure vulnerability that stems from improper access control mechanisms within its frontmatter processing logic. This flaw specifically affects users who possess page editing permissions, allowing them to manipulate the configuration data exposed during rendering processes. The core of the issue lies in how Grav handles special directives prefixed with config- when they are added to page frontmatter forms. These directives were intended for internal use or restricted administrative functions but are inadvertently processed by the public-facing Twig template engine without adequate sanitization or restriction checks, leading to a significant breach of confidentiality.
The technical mechanism behind this vulnerability involves the bypassing of the Twig sandbox's config_denied_paths redaction feature. In normal operation, Grav employs a security layer designed to prevent access to sensitive configuration files and variables through templating engines. However, by injecting specific directives into page frontmatter, an attacker can trick the system into exposing internal state data that should remain hidden from end-users. This bypass is particularly dangerous because it leverages legitimate user permissions for page editing rather than requiring administrative privileges or unauthenticated access to exploit the flaw. The vulnerability effectively transforms a standard content management feature into a vector for extracting sensitive environmental variables and security credentials stored within the Grav configuration files.
The operational impact of this vulnerability is severe, as it leads to the exposure of high-value security assets including the system's salt value used for password hashing, plugin-specific credentials such as API keys or database passwords, and Redis session storage passwords. The disclosure of the security.salt allows attackers to potentially perform offline brute-force attacks against user accounts with significantly reduced computational cost compared to standard hash cracking methods. Furthermore, exposing plugin credentials can lead to unauthorized access to third-party services integrated into the Grav installation, such as external APIs or cloud storage solutions. If Redis passwords are leaked, an attacker could gain control over session data and caching mechanisms, potentially leading to further system compromise or denial of service conditions by manipulating cached content or hijacking user sessions.
This vulnerability aligns with CWE-209 Generation of Error Message Containing Sensitive Information, as it results in the unintended exposure of sensitive configuration details through normal application functionality. It also maps to ATT&CK technique T1530 Data from Cloud Storage Object Misconfiguration if the exposed data includes cloud-based credentials, and generally falls under T1087 Account Discovery for identifying valid system accounts via salt leakage. The attack vector is classified as Local with High Privileges required in some contexts but can be escalated to Remote Exploitation depending on whether page editing permissions are granted to untrusted users or public-facing editors.
Mitigation strategies must prioritize immediate patching of the Grav installation to version 2.2.2 or later, where this specific frontmatter processing flaw has been addressed by developers through stricter validation and sanitization of config- prefixed directives. In environments where upgrading is not immediately feasible, administrators should restrict page editing permissions to trusted individuals only and audit existing pages for any injected config-*@ directives that might have been added maliciously during previous exploitation attempts. Additionally, rotating all exposed credentials including the security salt, plugin API keys, and Redis passwords is essential to neutralize potential damage from past exposures. Implementing a Web Application Firewall with rules targeting frontmatter manipulation patterns can provide an additional layer of defense by blocking requests containing suspicious directive injections before they reach the application logic.