Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

Grav CMS versions before 2.0.16 contain an incomplete default denylist in the Twig sandbox configuration. This flaw allows attackers with page-edit permissions to access sensitive system configuration secrets via config.get() or config.toArray() functions in Twig templates. Sensitive values such as Redis passwords can be exposed when config_access is enabled. The vulnerability is classified as an information disclosure issue rooted in improper sandboxing controls. A fix was introduced in Grav version 2.0.16. The issue has been documented in NVD, GitHub Security Advisories, and VulnCheck. Organizations using Grav CMS with config_access enabled and Redis or other sensitive integrations are at elevated risk. Upgrading to version 2.0.16 or later is the recommended remediation.