CVE-2026-114657 in Grav
Summary
by MITRE • 10/22/2026
Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability in Grav versions prior to 2.2.5 represents a critical information disclosure flaw rooted in the improper handling of HTTP authentication headers within Twig template rendering processes. This issue specifically affects page authors who possess the ability to inject custom code or content into pages via Twig syntax. The core technical failure lies in the framework's tendency to expose sensitive server variables, such as PHP_AUTH_USER and PHP_AUTH_PW, which are populated when a user accesses a resource protected by HTTP Basic Authentication. By leveraging these exposed variables within an inline style attribute for a background image, an attacker can construct a malicious request that forces the victim's browser to send their credentials in plaintext to a remote server controlled by the author or an external party.
From a technical perspective, this vulnerability exploits the intersection of web server authentication mechanisms and client-side rendering engines. When a user attempts to access a protected page, the web server prompts for credentials via HTTP Basic Auth. These credentials are then stored in the PHP superglobal variables $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW']. If Grav's Twig engine processes these variables without adequate sanitization or context-aware escaping when rendering HTML stylesheets embedded within the page content, it allows the direct injection of this sensitive data into the DOM. The exploitation vector involves setting a background-image URL in CSS to an external domain, appending the captured username and password as query parameters. This technique effectively turns every visitor with valid credentials into an unwitting agent for credential exfiltration.
The operational impact of this vulnerability is severe, particularly in environments where Grav serves administrative interfaces or internal tools protected by HTTP Basic Authentication. Administrators who access these pages using standard browsers will have their high-privilege credentials silently transmitted to an attacker-controlled endpoint without any visual indication that a breach has occurred. This leads directly to unauthorized access, potential full system compromise if the administrator holds elevated privileges across multiple systems due to credential reuse, and significant data confidentiality breaches. The stealthy nature of this attack makes detection difficult through standard logging mechanisms unless specific outbound traffic monitoring is in place.
This vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information useful for attackers, as well as CWE-798, concerning the use of hardcoded credentials or exposure of sensitive data via client-side injection. In terms of offensive security frameworks, this technique maps to ATT&CK T1539, specifically Steal Web Session Cookie, although adapted here for HTTP Basic Auth headers rather than session cookies. It also relates to T1087, Account Discovery, as it facilitates the gathering of valid usernames and passwords that can be used for further lateral movement or brute-force attacks against other services.
Mitigation strategies must focus on immediate patching and architectural hardening. The primary remediation is to upgrade Grav to version 2.2.5 or later, where this specific Twig rendering behavior has been corrected to prevent the exposure of PHP_AUTH variables in unsafe contexts. For environments that cannot immediately update due to compatibility constraints, administrators should avoid using HTTP Basic Authentication for any pages rendered by vulnerable versions of Grav. Instead, more robust authentication mechanisms such as form-based login with secure session management or OAuth2 providers should be implemented. Additionally, implementing strict Content Security Policy headers can help mitigate the impact by restricting where background images are allowed to load from, thereby preventing exfiltration to unauthorized external domains even if the vulnerability is present. Regular security audits of Twig templates and server configuration reviews are recommended to ensure no other similar exposure vectors exist within the application stack.