CVE-2026-44738: Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

May 13, 2026

The Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required.

References

github.com/advisories/GHSA-j274-39qw-32c9
github.com/getgrav/grav/releases/tag/2.0.0-rc.2
github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9
nvd.nist.gov/vuln/detail/CVE-2026-44738

Code Behaviors & Features

Detect and mitigate CVE-2026-44738 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →