CVE-2026-61842

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.

• CWE-200

• https://github.com/getgrav/grav/commit/7efe70574e4cf01a251318478c13673029e93eb6
• https://github.com/getgrav/grav/releases/tag/2.0.2
• https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61833zot is a container image and artifact registry based on the …8.1
• CVE-2026-61835Directus is a real-time API and App dashboard for managing S…7.7
• CVE-2026-61836Directus is a real-time API and App dashboard for managing S…8.6
• CVE-2026-61839Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6184A weakness has been identified in code-projects Simple Conte…2.4
• CVE-2026-61841Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61857ImageMagick before 7.1.2-26 contains a heap use-after-free v…7.5
• CVE-2026-61858ImageMagick before 7.1.2-26 contains a policy bypass vulnera…5.3
• CVE-2026-61859ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 co…4.8
• CVE-2026-6186A security vulnerability has been detected in UTT HiPER 1200…8.8
• CVE-2026-61860ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-aft…6.3
• CVE-2026-61861ImageMagick before 7.1.2-26 contains a use-after-free vulner…7.5