CVE-2026-114657 getgrav CVE debrief

Who should care

Grav site administrators, security teams, and page authors who create or edit Twig page content should assess exposure and take necessary actions to prevent potential credential disclosure.

Why it matters

CVE-2026-114657 is a medium-severity information disclosure vulnerability in Grav that allows page authors to capture visitors' HTTP Basic credentials. Site administrators and security teams should assess exposure, especially if page authors can create or edit Twig content, and update to version 2.2.5 or later. The vulnerability's impact and scope require verification from official sources.

• Potential credential disclosure for administrators accessing sensitive areas of the Grav site.
• Possible unauthorized access to sensitive areas of the site using exfiltrated credentials.
• Need for verification of Grav version and exposure to potential exploitation.
• Priority for updating to Grav version 2.2.5 or later to mitigate the vulnerability.

Technical summary

The vulnerability allows page authors to capture visitors' HTTP Basic credentials through Twig page content in Grav versions from 2.0.0 before 2.2.5. Authors can exploit this by printing the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host. Affected Grav site administrators and security teams should assess exposure, especially if page authors can create or edit Twig content, and update to version 2.2.5 or later.

Defensive priority

Medium priority for Grav site administrators and security teams to assess exposure and update to version 2.2.5 or later.

Recommended defensive actions

• Assess exposure by checking if the Grav site uses versions between 2.0.0 and 2.2.5.
• Verify if page authors can create or edit Twig page content.
• Update to Grav version 2.2.5 or later.
• Monitor for suspicious Twig page content changes.
• Restrict access to sensitive areas for page authors.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected deployments and potential impact require further verification. Affected product deployments need to be confirmed in managed environments. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance. The vulnerability allows page authors to capture visitors' HTTP Basic credentials through Twig page content in Grav versions from 2.0.0 before 2.2.5. Authors can exploit this by printing the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.