CVE-2026-44738

HighCVSS 7.7/10Last modified Oct 26, 2026

Description

Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
getgrav	grav	< 2.0.0-rc.2

References

https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9Exploit, Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9Exploit, Vendor Advisory

Timeline

Published: May 11, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-447398.7Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundl CVE-2026-44746.1A flaw has been found in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_single_student_up CVE-2026-447406.5Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle cr CVE-2026-447418.8Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in P CVE-2026-447426.1Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild CVE-2026-447433.7Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP Business Objects application leaks sensitive infor CVE-2026-447446.5SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an aut CVE-2026-447458.1SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an CVE-2026-447466.1Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an unauthenticated attacker could cra CVE-2026-447479.9SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory cor CVE-2026-447489.9SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed mes CVE-2026-447494.3The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex