THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-mc5q-6hpj-rp7j (medium) — Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

[GHSA] GHSA-mc5q-6hpj-rp7j (medium) — Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

medgithub_advisoriesPublished 2026-09-02

GHSA-mc5q-6hpj-rp7j Severity: medium CVE: CVE-2026-61842

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

### Summary

The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get`/`toArray` from the method allowlist (GHSA-j274-39qw-32c9), so editor content can't read config secrets via `config`. That's

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-44738cve
CVE-2026-61842cve

Original source: https://github.com/advisories/GHSA-mc5q-6hpj-rp7j