Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

Affected: Packagist: getgrav/grav

## Summary

`system/config/security.yaml`'s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `security`, `backups`, `scheduler`) omits the `system` prefix. When an operator enables the documented, non-default `twig_content.config_access: true` setting (intended to safely expose low-sensitivity values like `site.title` to editor-authored Twig content), any real secret stored under `system.*` , for example `system.cache.redis.password` , is also exposed, both via `config.get(...)` and via `config.toArray()`, to any user with page-edit permission.

This is a follow-up gap in the fix for GHSA-j274-39qw-32c9 (config.toArray() secret exfiltration): that fix correctly introduced a `SandboxConfig` facade with a denylist, but the shipped default denylist is incomplete.

## Environment used to verify

- Grav commit at HEAD of the default branch, `GRAV_VERSION` `2.0.15` - PHP 8.3.6 with curl, zip, dom, gd extensions installed - Full `composer install --no-dev` run against the real repository (no mocked dependencies) so the actual `Grav\Common\Config\Config` and `Grav\Common\Twig\Sandbox\SandboxConfig` classes could be exercised directly

## Commands run to set up the verification environment

```bash git clone https://github.com/getgrav/grav.git cd grav

# install missing PHP extensions required by composer.json apt-get install -y php8.3-curl php8.3-zip php8.3-xml php8.3-gd

# composer.phar fetched directly from GitHub releases curl -sL -o /tmp/composer.phar \…