CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox
Attackers with page-edit permissions can retrieve sensitive system configuration secrets via Twig templates in Grav CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76846?
CVE-2026-76846 is a high-severity vulnerability in getgrav grav, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.
Weakness: CWE-522
Which versions are affected by CVE-2026-76846?
2 open source packages ship an affected version, including getgrav/grav.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 2.0.16 |
getgrav/grav Packagist | All versions | 2.0.16 |
How do I fix CVE-2026-76846?
Upgrade getgrav/grav to 2.0.16 or later.
Is CVE-2026-76846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76846 exists.
Sources
Also known as GHSA-xjw5-q542-3vmr.