{"schema":"threatline.record/2","record":{"id":"GHSA-c85g-q5w4-ff68","aliases":["GHSA-c85g-q5w4-ff68"],"summary":"Page authors can capture visitors' HTTP Basic credentials through Twig in page content","details":"## Summary\n\nOn a site where visitors authenticate with HTTP Basic credentials, a user who can only write pages could add Twig to page content that reads the Basic username and password of whoever views the page, and sends them to a host of the author's choosing. Sites that do not use HTTP Basic authentication are not affected.\n\n## Affected versions\n\nGrav 2.0.0 through 2.2.4. From 2.0.19 Twig in page content is on by default, so every page writer can use it. On 2.0.0 to 2.0.18 only sites that had turned on `security.twig_content.process_enabled` are affected. Grav 1.7 has no content sandbox, so page authors there already have unrestricted Twig and there is no boundary for this issue to cross.\n\n## Details\n\nGrav built the current request's `Uri` object with the visitor's Basic credentials taken from PHP's `PHP_AUTH_USER` and `PHP_AUTH_PW`, which PHP fills from the `Authorization: Basic` header. `Uri::toArray()` returned them as `user` and `pass`, and `Uri::__toString()` wrote them into the address as `user:pass@host`.\n\nThe Twig content sandbox allows `toarray` and `__tostring` on `Grav\\Common\\Uri`, so page content could print the credentials with `{{ uri.toarray.pass }}` or simply `{{ uri }}`, as well as through `url(uri)`, `uri|array` and `uri|yaml_encode`. The original report names `toArray()`; printing the object is enough. Placed inside an inline style that loads a background image from another host, the value is sent there when the visitor's browser loads the page.\n\nOn versions before 2.0.25 the rendered result was also stored in the shared page cache, so one visitor's credentials could be served to later visitors.\n\n## Impact\n\nA page author learns the HTTP Basic username and password of other visitors, including administrators. This matters where each visitor has their own Basic credentials, for example a per-user htpasswd file or Basic authentication backed by LDAP or another directory, where the password may also open other systems. Where a single shared Basic password is already known to every author, nothing new is exposed.\n\n## Patches\n\nFixed in Grav 2.2.5. The request `Uri` no longer carries the visitor's Basic credentials, so nothing in page content or in a theme can print them. `Uri::user()` and `Uri::password()` are now empty for the current request; code that needs the Basic credentials should read them from the server variables directly. No configuration change is needed, including on sites with their own `security.twig_sandbox` allowlist.\n\n## Credits\n\nReported by @baeseungwon1010.\n","categories":["Unclassified"],"product":"getgrav/grav","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/getgrav/grav/security/advisories/GHSA-c85g-q5w4-ff68","source_modified_at":"2026-10-07T03:04:03Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"getgrav/grav"},"range":">= 2.0.0, < 2.2.5"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/getgrav/grav/security/advisories/GHSA-c85g-q5w4-ff68","source_modified_at":"2026-10-07T03:04:03Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"getgrav/grav"},"version":"2.2.5"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-07T03:04:03Z","modified_at":"2026-10-07T03:04:03Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/getgrav/grav/security/advisories/GHSA-c85g-q5w4-ff68","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-07T03:04:03Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T03:04:03Z","content_hash":"bf14032fed7f05c07ed2a764b9cb8b56f18c3577f7c30893f08990ab47bd685c"}}