CVE-2026-92917

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-92917

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92917.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-92917

Aliases

GHSA-rfr9-7h4p-gx2x

Published

2026-09-17T11:16:45Z

Modified

2026-09-20T11:30:42Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Details

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled and dump Grav's entire merged configuration — print_r reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92917.json"
}

References

Affected packages

Git / github.com/getgrav/grav

Affected ranges

Type

GIT

Repo

https://github.com/getgrav/grav

Events

Introduced

1f83c8bccc0be87e49ab9858ed772261b350fc2c

Fixed

bc216085962fb14054b0a8ad4a4e56906994fc4b

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.0.0-rc.1"
        },
        {
            "fixed":  "2.0.22"
        },
        {
            "fixed":  "2.0.21"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92917.json"