GHSA-crrc-vpp2-f5x7

Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Published

2026-08-25

Modified

2026-09-17

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references. ### Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-crrc-vpp2-f5x7