CVE-2026-44738: Grav CMS Twig Sandbox Information Disclosure via Config::toArray()

Vulnerability ID: CVE-2026-44738

CVSS Score: 7.7

Published: 2026-05-13

An information disclosure vulnerability in the Grav CMS file-based Web platform allows authenticated users with the admin.pages role to bypass Twig sandbox restrictions. By invoking the config.toArray() method, attackers can expose complete system configurations, including highly sensitive SMTP passwords, API tokens, and cloud service credentials.

TL;DR

Authenticated Grav CMS users with page-editing privileges can inject a specific Twig template payload to bypass the security sandbox.…