CVE-2026-100671
Deferred Deferred - Pending Action

Session Cookie Exposure in Grav CMS via Twig Processing

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100671
EUVD
EUVD-2026-87765

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
grav grav From 2.0.19 (inc) to 2.0.24 (inc)
grav grav From 2.0.0 (inc) to 2.0.18 (inc)
grav grav 1.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Grav CMS versions 2.0.19 through 2.0.24 and earlier versions where Twig content processing is enabled. A user with only page-write permission can craft a page that reads any request cookies, including session cookies, via a Twig sandbox function called get_cookie(). The rendered page content, including the captured session cookie, is stored in a shared cache accessible to all visitors. This allows an attacker to retrieve the session cookie without authentication and replay it to gain administrative access.

Detection Guidance

Check Grav CMS version with: grep -r 'version' /path/to/grav/system/blueprints.yaml. If version is between 2.0.19 and 2.0.24 or Twig content processing is enabled in older versions, the system is vulnerable. Inspect cached pages for session data in /var/www/html/cache/. Look for pages rendered via Twig that may contain cookie values.

Impact Analysis

If you are an administrator viewing a page created by a low-privilege user, your session cookie could be captured and stored in a shared cache. An attacker can then access this cached page to retrieve your session cookie and replay it to authenticate as you, gaining full administrative privileges without needing your password.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Compromised session cookies may allow attackers to access protected health information or personal data, resulting in compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade Grav CMS to version 2.0.25 or later immediately. Disable Twig content processing by setting security.twig_content.process_enabled: false in system.yaml. Clear all cached pages with rm -rf /path/to/grav/cache/*.php. Restrict page-write permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart