CVE-2026-114657— Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
Quick assessment
Affected
getgrav grav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grav 2.0.0 至 2.2.5 版本存在信息泄露漏洞，允许页面作者通过 Twig 页面内容捕获访问者的 HTTP 基本身份验证凭据。攻击者可在内联样式背景图像中打印请求 URI 对象（该对象嵌入了 PHP_AUTH_USER 和 PHP_AUTH_PW 变量），从而将管理员凭据外泄至外部主机。
Possible ATT&CK Techniques 3 AI
T1048 · Exfiltration Over Alternative Protocol T1190 · Exploit Public-Facing Application T1566 · Phishing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114657
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
Source: CVE Program / CVE List V5
Vulnerability Description
Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114657
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114657
请登录查看更多情报信息。
Other References for CVE-2026-114657 (2)
Same Patch Batch · getgrav · 2026-10-22 · 4 CVEs total
| CVE-2026-114658 | 8.8 HIGH | Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite |
| CVE-2026-114659 | 6.5 MEDIUM | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes |
| CVE-2026-114660 | 6.3 MEDIUM | Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives |
IV. Related Vulnerabilities
Same product: grav
-
CVE-2026-114660
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex -
CVE-2026-112782
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Deni -
CVE-2026-112780
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Fl -
CVE-2026-112781
Grav 2.0.0 before 2.2.2 Information Disclosure via Form conf -
CVE-2026-109326
Grav before 2.1.7 Information Disclosure via Nested .git Dir
Same vendor: getgrav
-
CVE-2026-114660
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex -
CVE-2026-114659
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass v -
CVE-2026-114658
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation v -
CVE-2026-112782
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Deni -
CVE-2026-112781
Grav 2.0.0 before 2.2.2 Information Disclosure via Form conf
Same weakness: CWE-200
-
CVE-2026-114574
massCodeIO massCode Local HTTP Service index.ts information -
CVE-2026-76307
Sensitive Information Disclosure through REST API Query Filt -
CVE-2026-76306
Information Disclosure through REST API Query Filters in Spl -
CVE-2026-113706
a2aproject a2a-rs inmemory.rs information disclosure -
CVE-2026-113157
Chrome 156 前 Windows 版 ANGLE 信息泄露漏洞
V. Comments for CVE-2026-114657
No comments yet