CVE-2026-92917 in Grav
Summary
by MITRE • 09/17/2026
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled and dump Grav's entire merged configuration — print_r reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Grav versions 2.0.0-rc.1 through 2.0.21 represents a critical failure in the implementation of the Twig content sandboxing mechanism, leading to unauthorized access to sensitive configuration data. Grav is a flat-file CMS that utilizes Twig for template rendering and allows users with page-edit permissions to inject custom code into page content when Twig processing is enabled. The core technical flaw lies within the GravExtension::assertSandboxDumpSafe() function, which is designed to prevent potentially dangerous functions from executing inside the sandboxed environment. This security check determines whether the current execution context is sandboxed by invoking SandboxExtension::isSandboxed(). However, this method call lacks a Source argument, causing it to rely solely on a global sandbox flag rather than evaluating the specific source of the template being rendered. Since Grav never enables this global sandbox flag for standard page content rendering, the function incorrectly reports that no sandbox is active or fails to enforce restrictions appropriately, thereby bypassing the security guard introduced in GHSA-mc5q-6hpj-rp7j.
This architectural oversight allows an authenticated user with minimal privileges, specifically those granted only page-edit rights, to exploit Twig filters such as print_r, vardump, json_encode, yaml_encode, and string within their content. By injecting a payload like {{ config|print_r }}, the attacker can trigger the rendering of Grav's entire merged configuration object. The vulnerability is particularly severe because it bypasses path redaction mechanisms intended to hide sensitive file paths. The print_r function reflects the real Config object held in a private property of the SandboxConfig facade, exposing internal structures that are normally abstracted from end users. This results in the leakage of highly sensitive information including SMTP credentials for email services, API tokens for third-party integrations, webhook secrets used to verify incoming requests, and passwords associated with cache backends. Such exposure compromises the confidentiality integrity of the entire system, as these credentials can be leveraged by attackers to gain further access, manipulate data, or disrupt service availability.
The impact of this vulnerability aligns closely with CWE-209: Generation of Error Message Containing Sensitive Information and CWE-798: Use of Hard-coded Credentials, although the primary issue is the improper restriction of API usage within a security boundary, categorized under CWE-693: Protection Mechanism Failure. From an ATT&CK perspective, this vulnerability facilitates Data from Information Repositories (T1504) as it allows for the extraction of configuration data that serves as a repository for system secrets and credentials. The ability to dump internal objects also touches upon Discovery techniques related to System Configuration Discovery (T1082), enabling attackers to map out the application's architecture and dependencies based on exposed plugin configurations. It is important to note that Grav version 1.7 is not affected by this specific issue because it does not ship with a Twig content sandbox, meaning the attack vector relying on sandbox bypass logic is non-existent in earlier versions.
The resolution for this vulnerability was implemented in Grav version 2.0.22 through a fundamental change in how dangerous filters are registered within the Twig environment. The affected filters were updated to be registered with Twig's needs_is_sandboxed flag, which ensures that the security checks correctly evaluate the sandbox state relative to the specific source of the template being processed rather than relying on a flawed global state check. This correction enforces proper isolation between user-generated content and system-level configuration access. To mitigate this risk in affected systems, administrators must immediately upgrade Grav to version 2.0.22 or later. For environments where upgrading is not immediately feasible, disabling Twig processing for page content effectively neutralizes the attack vector by preventing the execution of injected Twig code entirely. Additionally, implementing strict input validation and ensuring that only trusted users have access to pages with Twig enabled can reduce the surface area, though these are compensating controls rather than definitive fixes given the severity of the underlying framework flaw.