{"vulnerability": "cve-2026-4473", "sightings": [{"uuid": "07fd07b3-c1f7-479c-b277-ce2170912705", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44738", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mllsbarcwj2g", "content": "\ud83d\udfe0 CVE-2026-44738 - High (7.7)\n\nGrav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any u...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-44738/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-11T17:27:10.752666Z"}, {"uuid": "485b4361-b8dd-4dce-9ec6-71318900a7f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44738", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mllsbarcwj2g", "content": "\ud83d\udfe0 CVE-2026-44738 - High (7.7)\n\nGrav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any u...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-44738/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-11T17:27:10.751603Z"}, {"uuid": "a88f4f51-ce48-40a9-b435-ac2ca1534b0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44738", "type": "seen", "source": "https://gist.github.com/alon710/ef3efe37eacc8d375596cddc56ee3bfb", "content": "# CVE-2026-44738: CVE-2026-44738: Grav CMS Twig Sandbox Information Disclosure via Config::toArray()\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-05-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-44738\n\n## Summary\nAn information disclosure vulnerability in the Grav CMS file-based Web platform allows authenticated users with the admin.pages role to bypass Twig sandbox restrictions. By invoking the config.toArray() method, attackers can expose complete system configurations, including highly sensitive SMTP passwords, API tokens, and cloud service credentials.\n\n## TL;DR\nAuthenticated Grav CMS users with page-editing privileges can inject a specific Twig template payload to bypass the security sandbox. This action dumps the entire site configuration, exposing critical secrets such as AWS keys and OAuth client secrets to the attacker.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (Authenticated)\n- **CVSS Score**: 7.7\n- **EPSS Score**: 0.00031\n- **Impact**: Information Disclosure (High)\n- **Exploit Status**: Proof of Concept Available\n\n## Affected Systems\n\n- Grav CMS Core\n- Grav CMS Admin Plugin\n- Twig Templating Engine Integration\n- **Grav CMS**: < 2.0.0-rc.2 (Fixed in: `2.0.0-rc.2`)\n\n## Mitigation\n\n- Upgrade Grav CMS to version 2.0.0-rc.2 or later to apply the official sandbox policy fix.\n- Audit user roles and remove the `admin.pages` role from unnecessary or unverified accounts.\n- Rotate all API keys, SMTP credentials, AWS tokens, and system security salts stored within the Grav configuration.\n\n**Remediation Steps:**\n1. Backup the current Grav CMS file system and user data.\n2. Execute the update procedure via the Grav CLI command `bin/gpm selfupgrade` or through the admin panel.\n3. Verify that the system is running at least version 2.0.0-rc.2.\n4. Identify all third-party credentials stored in the `user/config/` directory.\n5. Generate new credentials for all affected third-party services and update the Grav configuration.\n\n## References\n\n- [GitHub Security Advisory GHSA-j274-39qw-32c9](https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9)\n- [NVD Record for CVE-2026-44738](https://nvd.nist.gov/vuln/detail/CVE-2026-44738)\n- [MITRE CVE Record for CVE-2026-44738](https://www.cve.org/CVERecord?id=CVE-2026-44738)\n- [Grav Version 2.0.0-rc.2 Release](https://github.com/getgrav/grav/releases/tag/2.0.0-rc.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-44738) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-13T15:40:29.000000Z"}, {"uuid": "b54ce0ac-a9ee-4d35-80ca-d8f138b489a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44738", "type": "published-proof-of-concept", "source": "https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9", "content": "", "creation_timestamp": "2026-05-09T10:54:58.000000Z"}, {"uuid": "5b6e0397-264b-4ca5-a282-fe3f4e752232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44737", "type": "published-proof-of-concept", "source": "https://github.com/getgrav/grav/security/advisories/GHSA-fmg2-f5r9-24qc", "content": "", "creation_timestamp": "2026-05-05T10:55:40.000000Z"}, {"uuid": "325e0b32-90a0-41f9-9fc4-1ee03fcf688f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44739", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mquroboa4d2j", "content": "CVE-2026-44739 - Pimcore: SQL Injection in Custom Reports Column Configuration\nCVE ID : CVE-2026-44739\n \n Published : July 17, 2026, 8:17 p.m. | 17\u00a0minutes ago\n \n Description : Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3...", "creation_timestamp": "2026-07-17T22:16:29.426267Z"}, {"uuid": "4e53a718-07df-4336-bb6e-259109142601", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44739", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwqjbv3ri2g", "content": "\ud83d\udfe0 CVE-2026-44739 - High (8.7)\n\nPimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-44739/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-18T17:01:08.262575Z"}, {"uuid": "114d3a04-5c7a-4577-85f9-8e6613c56b97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44739", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mqxeshlz6r2d", "content": "CVE-2026-44739 - SQLi in Pimcore. Attackers with reports_config permission can execute arbitrary SELECT/UNION queries. CVSS 8.7. No patch yet. Monitor and restrict access. #CVE #Pimcore #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-44739/", "creation_timestamp": "2026-07-18T23:04:11.139823Z"}, {"uuid": "4d3ae60e-fc74-4ea3-83f8-cedf4bc48969", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44739", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/116943478032060676", "content": "CVE-2026-44739 - SQLi in Pimcore. Attackers with reports_config permission can execute arbitrary SELECT/UNION queries. CVSS 8.7. No patch yet. Monitor and restrict access. #CVE #Pimcore #infosec\nhttps://www.valtersit.com/cve/CVE-2026-44739/", "creation_timestamp": "2026-07-18T23:04:24.156807Z"}, {"uuid": "774a0b73-7b00-4e30-9c2c-913e71562e32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44739", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mqxihekm7z2g", "content": "Pimcore SQL Injection, Because Access Control Was Apparently Optional\nPANIC 78% | Lag 0.0h | CVE-2026-44739 is an SQL injection flaw in Pimcore where attackers with reports_config permission ca\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-19T00:09:32.929457Z"}]}