CVE-2026-114657

Overview

Grav CMS versions 2.0.0 through 2.2.4 allow page authors to capture visitors' HTTP Basic credentials via Twig page content. The vulnerability enables exfiltration of administrator credentials through an inline style background image. It affects sites that use HTTP Basic authentication and expose Twig templates to page authors.

Description

Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.

Impact

Confidentiality is compromised as administrators' usernames and passwords can be extracted. Integrity is at risk if attackers use the credentials to modify site content. Availability is not directly impacted. Site administrators, page authors, and visitors are the primary stakeholders.

Remediation

Apply the official patch to Grav CMS 2.2.5 or later. Disable HTTP Basic authentication if not required, or restrict its use to trusted IP ranges. Review Twig templates to ensure no request URI objects are printed in styles or other client‑side contexts. Monitor logs for unusual credential exfiltration attempts.

Risk context

The CVSS v3 score of 5.7 and v4 score of 6.9 classify this as medium severity. With no EPSS data, the risk remains moderate but should be addressed promptly to prevent credential leakage.

Affected products

• Grav CMS
• Grav CMS 2.0-2.2.4