https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:28:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-360018 EUVD-2026-360018 https://cve.radiocsirt.org/vuln/euvd-2026-360018 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76846 <p>Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.</p> <p>Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-76846 https://cve.radiocsirt.org/vuln/ghsa-xjw5-q542-3vmr <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>`system/config/security.yaml`&#39;s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `security`, `backups`, `scheduler`) omits the `system` prefix. When an operator enables the documented, non-default `twig_content.config_access: true` setting (intended to safely expose low-sensitivity values like `site.title` to editor-authored Twig content), any real secret stored under `system.*` , for example `system.cache.redis.password` , is also exposed, both via `config.get(...)` and via `config.toArray()`, to any user with page-edit permission.</p> <p>This is a follow-up gap in the fix for GHSA-j274-39qw-32c9 (config.toArray() secret exfiltration): that fix correctly introduced a `SandboxConfig` facade with a denylist, but the shipped default denylist is incomplete.</p> <p>## Environment used to verify</p> <p>- Grav commit at HEAD of the default branch, `GRAV_VERSION` `2.0.15` - PHP 8.3.6 with curl, zip, dom, gd extensions installed - Full `composer install --no-dev` run against the real repository (no mocked dependencies) so the actual `Grav\Common\Config\Config` and `Grav\Common\Twig\Sandbox\SandboxConfig` classes could be exercised directly</p> <p>## Commands run to set up the verification environment</p> <p>```bash git clone https://github.com/getgrav/grav.git cd grav</p> <p># install missing PHP extensions required by composer.json apt-get install -y php8.3-curl php8.3-zip php8.3-xml php8.3-gd</p> <p># composer.phar fetched directly from GitHub releases curl -sL -o /tmp/composer.phar \…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>`system/config/security.yaml`&#39;s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `security`, `backups`, `scheduler`) omits the `system` prefix. When an operator enables the documented, non-default `twig_content.config_access: true` setting (intended to safely expose low-sensitivity values like `site.title` to editor-authored Twig content), any real secret stored under `system.*` , for example `system.cache.redis.password` , is also exposed, both via `config.get(...)` and via `config.toArray()`, to any user with page-edit permission.</p> <p>This is a follow-up gap in the fix for GHSA-j274-39qw-32c9 (config.toArray() secret exfiltration): that fix correctly introduced a `SandboxConfig` facade with a denylist, but the shipped default denylist is incomplete.</p> <p>## Environment used to verify</p> <p>- Grav commit at HEAD of the default branch, `GRAV_VERSION` `2.0.15` - PHP 8.3.6 with curl, zip, dom, gd extensions installed - Full `composer install --no-dev` run against the real repository (no mocked dependencies) so the actual `Grav\Common\Config\Config` and `Grav\Common\Twig\Sandbox\SandboxConfig` classes could be exercised directly</p> <p>## Commands run to set up the verification environment</p> <p>```bash git clone https://github.com/getgrav/grav.git cd grav</p> <p># install missing PHP extensions required by composer.json apt-get install -y php8.3-curl php8.3-zip php8.3-xml php8.3-gd</p> <p># composer.phar fetched directly from GitHub releases curl -sL -o /tmp/composer.phar \…</p> https://cve.radiocsirt.org/vuln/ghsa-xjw5-q542-3vmr