CVE-2026-76846: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

system/config/security.yaml’s default twig_sandbox.config_denied_paths list (plugins, streams, security, backups, scheduler) omits the system prefix. When an operator enables the documented, non-default twig_content.config_access: true setting (intended to safely expose low-sensitivity values like site.title to editor-authored Twig content), any real secret stored under system.* , for example system.cache.redis.password , is also exposed, both via config.get(...) and via config.toArray(), to any user with page-edit permission.

This is a follow-up gap in the fix for GHSA-j274-39qw-32c9 (config.toArray() secret exfiltration): that fix correctly introduced a SandboxConfig facade with a denylist, but the shipped default denylist is incomplete.