PT-2026-39647 · Grav · Grav

Revanth011 · Published 2026-05-11 · Updated 2026-05-14 · CVE-2026-44738

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-rc.2

Description The Twig sandbox allow-list permits any user with the admin.pages role to call the config.toArray() function from within a page body. This action dumps the entire merged site configuration into the rendered HTML, potentially exposing sensitive plugin secrets such as SMTP passwords, AWS keys, OAuth client secrets, and API tokens. This process does not require administrator privileges.

Recommendations Update to version 2.0.0-rc.2.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-44738

GHSA-J274-39QW-32C9

Affected Products

Grav

References · 8

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9 · Exploit
• https://osv.dev/vulnerability/GHSA-j274-39qw-32c9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44738 · Security Note
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav/releases/tag/2.0.0-rc.2 · Note
• https://reddit.com/r/VulnMatter/comments/1tcwxup/resumen_diario_de_vulnerabilidades_14052026 · Reddit Post
• https://t.me/cveNotify/163503 · Telegram Post
• https://twitter.com/CVEnew/status/2053932461474898076 · Twitter Post