CVE-2026-92917 getgrav CVE debrief

Who should care

Grav administrators and users with page-edit rights should assess exposure and apply patches to prevent potential configuration disclosure. This includes reviewing the current Grav version, checking for Twig processing enablement, and restricting page-edit rights to trusted users.

Why it matters

CVE-2026-92917 allows authenticated users to bypass the Twig content sandbox and dump Grav's entire merged configuration, exposing sensitive information. Grav administrators and users with page-edit rights should assess exposure and apply patches.

• An authenticated user with page-edit rights can access sensitive configuration values.
• Exposed configuration values may include SMTP credentials, API tokens, and cache backend passwords.
• The vulnerability requires verification of Grav version and Twig processing enablement.
• Remediation priority is high for affected Grav installations.

Technical summary

The Twig content sandbox in Grav fails to restrict the dump and serialize filters, allowing an authenticated user with page-edit rights to dump Grav's entire merged configuration. This occurs because GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables. As a result, the guard added in GHSA-mc5q-6hpj-rp7j never executes, enabling attackers to bypass the sandbox and access sensitive configuration.

Defensive priority

High priority for Grav administrators and users with page-edit rights to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the installed Grav version is within the affected range (2.0.0-rc.1 through 2.0.21) and if Twig processing is enabled.
• Apply the patch by upgrading to Grav version 2.0.22 or later.
• Restrict page-edit rights to trusted users and monitor for suspicious activity.
• Review and update sensitive configuration values, such as SMTP credentials and API tokens.
• Verify Grav version and Twig processing enablement.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is fixed in Grav version 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag. The issue is confirmed in versions 2.0.0-rc.1 through 2.0.21. Grav 1.7 is not affected as it does not ship with a Twig content sandbox.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.