THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-92917 (HIGH 7.5) — Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtens

[NVD] CVE-2026-92917 (HIGH 7.5) — Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtens

mednvdPublished 2026-09-17

CVE-2026-92917 CVSS: 7.5 HIGH Published: 2026-09-17T12:18:30.907

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which re

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-92917cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-92917