CVE-2026-61842
MediumCVSS 6.5Summary
Grav prior to 2.0.2 permits grav.offsetGet('config') to return the raw configuration object and allows json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials.
Risk Assessment
Exposure of configuration secrets can lead to account compromise, data theft, or further attacks on the infrastructure.
Recommendation
Update Grav to version 2.0.2 or later and restrict editing permissions to trusted users.
Original NVD description (English source)
Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.