CVE-2026-112781GHSA-8wwq-x3w5-fxmw
Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
getgrav grav
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.2gravCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.
Text from CVE List
Affected versions 2
- gravaffected: 2.0.0 before 2.2.2CVE List
- gravunaffected: 2.2.2CVE List