CVE-2026-61842 getgrav CVE debrief

Who should care

Page authors and Grav administrators should assess exposure and verify configuration secrets have not been exposed. Defenders should review and update Grav to version 2.0.2 or later to fix the issue. Grav administrators must update to version 2.0.2 or later. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials and API keys.

Why it matters

CVE-2026-61842 is a medium-severity vulnerability in Grav's Twig content sandbox that allows page authors to expose configuration secrets, including SMTP credentials and API keys. Defenders should verify configuration secrets have not been exposed and update to version 2.0.2 or later.

• Configuration secrets exposure requires verification and rotation
• Page authors can render sandboxed content exposing sensitive information
• Grav administrators must update to version 2.0.2 or later to fix the issue

Technical summary

The Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials.

Defensive priority

Medium priority for page authors and Grav administrators

Recommended defensive actions

• Review and update Grav to version 2.0.2 or later
• Restrict page-author permissions to minimize exposure
• Verify configuration secrets have not been exposed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Grav's Twig content sandbox, which allows page authors to expose configuration secrets. The issue is fixed in version 2.0.2. The CVE record was published on 2026-08-19T16:18:17.003Z and has not been modified since then. The vulnerability has a medium severity score of 6.5. The NVD entry and CVE record provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.