https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T19:01:18.308278+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-76846 fkie_cve-2026-76846 2026-09-28T19:01:18.312128+00:00

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

 https://vulnerability.circl.lu/vuln/ghsa-crrc-vpp2-f5x7 Withdrawn: GHSA-crrc-vpp2-f5x7 — Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.red… 2026-09-28T19:01:18.312215+00:00

Withdrawn by the publisher.

Affected: Packagist: getgrav/grav

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references.

### Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.