Grav CMS: Information disclosure of protected configuration via form directives

Summary

Grav 2.0.0 through 2.2.1 allows a user with page-edit permission to add config-*@ directives to page frontmatter forms. This bypasses the Twig sandbox redaction and writes protected values such as security.salt, plugin credentials and Redis passwords into the rendered page. The values are then visible to all visitors of that page, including anonymous users on the internet.

Affected

• Grav 2.0.0 up to but not including 2.2.2 (advisory lists 2.0.0 through 2.2.1)
• Grav 1.7 is not affected according to the advisory

Fixed in

• Grav 2.2.2

Workaround

• Unknown. The advisory lists no workaround because a fixed version exists.
• If you cannot patch now, restrict page-edit rights to trusted staff and review page frontmatter forms for config-*@ directives.

Exploitation

• The advisory does not mention exploitation.
• One aggregator reports that the sources do not mark it as known exploited.
• No public proof of concept found in the research. CISA KEV was not checked directly.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

• Update Grav to version 2.2.2 or later.
• Review which accounts have page-edit permission and remove unnecessary rights.
• Check existing pages for config-*@ directives in form frontmatter.
• If exposure is suspected, rotate the disclosed secrets (security.salt, Redis password, proxy and plugin credentials). Check the Grav documentation before rotating security.salt, as it may invalidate sessions and signed forms.
• Note that the CVSS score differs between sources (8.7 in CVE/CVSS 4.0, 6.5 and 4.3 elsewhere). Prioritise patching for sites with several editors or contractors.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub advisory GHSA-8wwq-x3w5-fxmw github.com
• Grav 2.2.2 release github.com
• VulnCheck advisory www.vulncheck.com
• OSV record CVE-2026-112781 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:56.