GHSA-mw85-cjh9-8hp7

Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Published

2026-08-25

Modified

2026-09-17

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p597-crqc-m349. This link is maintained to preserve external references. ### Original Description Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-mw85-cjh9-8hp7