CVE-2026-44738

high

Published 2026-05-13 · Modified 2026-05-13

CVSS v3

7.7

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVSS v2

—

VIR risk

7.7

Description

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Exploit likelihood

85%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9

Ecosystem	Package	Vulnerable	Fixed
Packagist	getgrav/grav	`<=2.0.0-rc.1`
Packagist	getgrav/grav	`<2.0.0-rc.2`	`2.0.0-rc.2`
COMPOSER	getgrav/grav	`<= 2.0.0-rc.1`	`2.0.0-rc.2`

Vendor	Product	Versions	Fixed
getgrav	grav	`{"endExcluding":"2.0.0"}`	`2.0.0`
getgrav	grav	`2.0.0`

CWE-200

Verify integrity in audit chain (admin only). AS-IS.