Vulnerability Description
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled and dump Grav's entire merged configuration — print_r reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav/security/advisories/GHSA-rfr9-7h4p-gx2x
- https://www.vulncheck.com/advisories/grav-2.0.0-rc.1-through-2.0.21-configuratio
- https://github.com/getgrav/grav/security/advisories/GHSA-rfr9-7h4p-gx2x
FAQ
What is CVE-2026-92917?
CVE-2026-92917 is a vulnerability with a CVSS score of 7.5 (HIGH). Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExte...
How severe is CVE-2026-92917?
CVE-2026-92917 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92917?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.