https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 01:00:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-356475 EUVD-2026-356475 https://cve.radiocsirt.org/vuln/euvd-2026-356475 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61842 <p>Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet(&#39;config&#39;) to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.</p> <p>Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet(&#39;config&#39;) to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-61842 https://cve.radiocsirt.org/vuln/ghsa-mc5q-6hpj-rp7j <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get`/`toArray` from the method allowlist (GHSA-j274-39qw-32c9), so editor content can&#39;t read config secrets via `config`. That&#39;s bypassable: `grav` is the raw container, `offsetget` is allow-listed on it, so `grav.offsetGet(&#39;config&#39;)` returns the real `Config`. The allow-listed filters `json_encode`/`print_r`/`yaml_encode` then serialize it at the PHP level, never hitting the sandbox method gate, dumping the whole config tree including every `plugins.*` secret (SMTP creds, API keys, plugin DB creds). Incomplete fix for GHSA-j274-39qw-32c9. `security.salt` does not leak (it lives outside config).</p> <p>### Details</p> <p>The documented path is blocked: `config` is the `SandboxConfig` facade (`Twig.php:660`) and the raw `Config`/`Data` method entries are stripped when `config_access` is false, so `{{ config.get(...) }}` returns the default and `{{ grav.offsetGet(&#39;config&#39;).get(...) }}` raises `SecurityNotAllowedMethodError`.</p> <p>The bypass uses two allow-listed primitives the redaction doesn&#39;t cover:</p> <p>1. `grav.offsetGet(&#39;config&#39;)` returns the raw `Config`. The `SandboxConfig` facade replaces only the `config` variable, not `grav[&#39;config&#39;]`; `offsetget` is allow-listed on `Grav\Common\Grav` in `system/config/security.yaml`. 2. `json_encode`/`print_r`/`yaml_encode` serialize the object inside the filter and never call `GravSecurityPolicy::checkMethodAllowed` (`GravSecurityPolicy…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get`/`toArray` from the method allowlist (GHSA-j274-39qw-32c9), so editor content can&#39;t read config secrets via `config`. That&#39;s bypassable: `grav` is the raw container, `offsetget` is allow-listed on it, so `grav.offsetGet(&#39;config&#39;)` returns the real `Config`. The allow-listed filters `json_encode`/`print_r`/`yaml_encode` then serialize it at the PHP level, never hitting the sandbox method gate, dumping the whole config tree including every `plugins.*` secret (SMTP creds, API keys, plugin DB creds). Incomplete fix for GHSA-j274-39qw-32c9. `security.salt` does not leak (it lives outside config).</p> <p>### Details</p> <p>The documented path is blocked: `config` is the `SandboxConfig` facade (`Twig.php:660`) and the raw `Config`/`Data` method entries are stripped when `config_access` is false, so `{{ config.get(...) }}` returns the default and `{{ grav.offsetGet(&#39;config&#39;).get(...) }}` raises `SecurityNotAllowedMethodError`.</p> <p>The bypass uses two allow-listed primitives the redaction doesn&#39;t cover:</p> <p>1. `grav.offsetGet(&#39;config&#39;)` returns the raw `Config`. The `SandboxConfig` facade replaces only the `config` variable, not `grav[&#39;config&#39;]`; `offsetget` is allow-listed on `Grav\Common\Grav` in `system/config/security.yaml`. 2. `json_encode`/`print_r`/`yaml_encode` serialize the object inside the filter and never call `GravSecurityPolicy::checkMethodAllowed` (`GravSecurityPolicy…</p> https://cve.radiocsirt.org/vuln/ghsa-mc5q-6hpj-rp7j