Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92917— Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Quick assessment

Affected
getgrav grav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grav 是一个基于平面文件的内容管理系统（CMS）。在 2.0.0-rc.1 至 2.0.21 版本中，Twig 内容沙箱未能正确限制 和 系列过滤器（包括 、 、 、 、 ）。具体原因在于： 在判断沙箱状态时，调用 时未传入 参数，而该调用仅返回全局沙箱标志位，而 Grav 从未启用过此全局标志，导致在 GHSA-mc5q-6hpj-rp7j 中新增的保护逻辑始终未执行。 因此，拥有页面编辑权限的已认证用户可以在启用了 Twig 处理功能的页面内容中插入 ，从而输出 Grav 完整的合并配置信息。 会反射显示存

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92917

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
Source: CVE Program / CVE List V5
Vulnerability Description
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled and dump Grav's entire merged configuration — print_r reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getgrav grav 2.0.0-rc.1 ~ 2.0.22 -

II. Public POCs for CVE-2026-92917

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92917

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92917 (2)

IV. Related Vulnerabilities

Same product: grav
Same vendor: getgrav
Same weakness: CWE-200

V. Comments for CVE-2026-92917

No comments yet

Leave a comment