CVE-2026-100668

Executive Summary

CVE-2026-100668 is a Twig content sandbox escape in the Grav flat-file CMS affecting versions 2.0.0 through 2.0.24. The vulnerability allows an attacker with the ability to author Twig markup in page content to escape the intended sandbox restrictions and read the underlying Pimple dependency injection container, disclosing the full configuration tree including credentials and secrets. Because malicious content is stored in the CMS, the exfiltrated configuration is rendered to anonymous visitors accessing the affected page, resulting in unauthenticated exposure of sensitive data (CVSS 6.5, CWE-200).

Technical Analysis

Grav is a modern flat-file CMS that uses the Twig templating engine. In Grav 2.0.x, a Twig content sandbox was introduced to restrict the capabilities of Twig code embedded within page content. The sandbox maintains an allowlist of filters and functions that content authors may invoke, and enforces a needs_is_sandboxed guard on sensitive ones such as print_r, vardump, json_encode, yaml_encode, and string.

CVE-2026-100668 stems from a gap in that allowlist: the array filter (and its identical function form) is registered without the needs_is_sandboxed guard, and its implementation calls toArray() — or falls back to a raw (array) cast — without consulting the sandbox’s method allowlist. Effectively, the sandbox believes array is safe while the implementation ignores sandbox policy enforcement.

The critical enabling factor is the grav Twig global, which exposes the raw Pimple-based dependency injection container. The container holds its services in a private $values array. Because array performs an unconditional array cast/toArray() call, a content author can evaluate grav|array to coerce the container into an array and read its private $values array. This array includes the Config service, which is returned un-redacted. A second array cast, per the description, then returns the entire configuration tree.

The exposed configuration tree is the one the sandbox’s redaction logic is specifically designed to protect. It contains plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the security.* subtree. No authentication beyond the ability to author Twig in page content (PR:L) is required, and no user interaction is needed (UI:N). Grav 1.7 is not affected because it has no Twig content sandbox; the vulnerability is exclusive to the 2.0.x sandbox implementation.

Because the malicious payload is persisted in page content and rendered by the CMS, the derived configuration data is not confined to a single attacker session — it is output to any anonymous visitor who loads the affected page. This shifts the vulnerability from a simple access-control oversight into a persistent data-exposure primitive.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-100668, and no Nuclei template exists. The attack chain below is inferred strictly from the vulnerability class and the details provided in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a Grav instance running a version between 2.0.0 and 2.0.24 that permits user-supplied Twig content in pages. This may be a site where untrusted users (editors, contributors, or any role able to author page content) can embed Twig.

2. How the flaw class is triggered. The sandbox’s allowlist admits the array filter without the needs_is_sandboxed guard. The attacker crafts Twig content that invokes array against the grav global. Because the implementation performs a toArray() or (array) cast without consulting the sandbox method allowlist, the sandbox check is bypassed and the container is coerced into an array.

3. Payload/execution method at the vulnerability-class level. The attacker embeds Twig markup in a page, first applying array to the grav global to expose the container’s private $values array, then applying a second array cast to obtain the full configuration tree. No specific function names, endpoints, or parameters beyond those named in the NVD description (array, toArray(), (array), grav, $values, Config) should be assumed.

4. Post-exploitation impact. The rendered page exposes plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the security.* subtree to any visitor, not just the attacker. This creates a persistent, anonymous-accessible disclosure channel. Captured secrets can then be used to pivot into adjacent services (mail relays, Redis, OAuth providers, proxies) or to further compromise the Grav installation.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, giving a base score of 6.5. Network reachability (AV:N) and no user interaction (UI:N) make exploitation remotely achievable once content-authoring access is present. Attack complexity is Low (AC:L). The only constraint is that the attacker must have some ability to author Twig in page content (PR:L), which is common in multi-editor deployments or any site that accepts contributor content.

The confidentiality impact is High (C:H): the full configuration tree is disclosed, including secrets meant to be hidden by the sandbox’s redaction logic. Integrity and availability are unaffected (I:N/A:N), as the vulnerability is a read-only disclosure primitive. The scope is Unchanged (S:U), since the same security authority (the Grav application) is exploited.

The blast radius extends beyond the CMS itself. Because disclosed secrets include plugin credentials, SMTP and OAuth secrets, Redis passwords, and proxy URLs, a single compromised Grav instance can lead to lateral movement into email infrastructure, caching layers, third-party integrations, and internal proxy paths. The security.* subtree may also weaken defenses that rely on those settings remaining confidential. Stored rendering to anonymous visitors increases the exposure window: the page remains accessible until the crafted content is removed.

Detection Guidance

Sigma Rule

title: Grav Twig Sandbox Escape via array filter on grav global
id: 8f3c2b41-5e7a-4f0c-9b2d-6c1d0a9e4f77
status: experimental
description: Detects Twig content in Grav pages attempting to abuse the array filter against the grav DI container to read configuration (CVE-2026-100668)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100668
author: threat-intel
date: 2026/01/01
logsource:
  product: webserver
  service: http
detection:
  selection_method:
    cs-method: 'POST'
  selection_body:
    - 'grav|array'
    - 'grav|array('
    - '|array}}'
    - 'array(grav'
  filter_static:
    cs-uri-query|contains: '/user/themes/'
  condition: selection_method and selection_body and not filter_static
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
falsepositives:
  - Legitimate development or theme work referencing the grav variable
level: high
tags:
  - attack.t1190
  - cve.2026.100668

YARA Rule

rule CVE_2026_100668_Grav_Twig_Sandbox_Escape
{
    meta:
        author = "threat-intel"
        description = "Detects Grav page content abusing the Twig array filter against the grav container (CVE-2026-100668)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100668"
        date = "2026-01-01"

    strings:
        $a1 = "grav|array"
        $a2 = "grav|array("
        $a3 = "|array}}"
        $a4 = "array(grav"
        $b1 = "toArray"
        $b2 = "$values"

    condition:
        any of ($a*) or (all of ($b*) and filesize < 2MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100668 Grav Twig Sandbox Escape Attempt (grav array filter)"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:"grav|array"; nocase; reference:cve,2026-100668; classtype:web-application-attack; sid:2026100668; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and
          http.request.body.content : ("grav|array", "grav|array(", "|array}}")]
  [http where http.request.method == "GET" and
          url.path : ("/user/", "/index.php") and
          http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=grav
| eval payload = coalesce(form_data, request_body, cs_uri_query, "")
| where match(payload, "(?i)grav\s*\|\s*array") OR match(payload, "(?i)array\(\s*grav")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, dest_host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,grav,cve-2026-100668,">
  <rule id="100668" level="12">
    <if_sid>31100</if_sid>
    <match>grav\|array</match>
    <description>CVE-2026-100668: Grav Twig sandbox escape attempt detected in HTTP request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100668,</group>
  </rule>
  <rule id="100669" level="12">
    <if_sid>31100</if_sid>
    <match>array(grav</match>
    <description>CVE-2026-100668: Grav Twig sandbox escape attempt detected (array cast on grav container)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100668,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict the ability to author Twig in page content to fully trusted administrators only; revoke contributor/editor roles that can embed Twig. Where possible, disable or tightly constrain Twig processing in content. Audit existing page content for any occurrence of the array filter or function applied to the grav global, and remove suspicious content. Isolate the Grav instance from sensitive back-end services (SMTP, Redis, OAuth providers, proxies) whose credentials appear in the configuration tree, and rotate any credentials that may have been exposed. Because the payload is stored and rendered to anonymous visitors, treat the site as potentially compromised until content is reviewed and credentials rotated.

2. Patch/upgrade steps. No vendor patch evidence is currently available from tracked sources. Grav 2.0.25 is identified as the fixed version in the NVD description; upgrade to 2.0.25 or later as soon as a trusted vendor release is obtained and verified. Until then, treat 2.0.0 through 2.0.24 as vulnerable. Grav 1.7 is not affected because it has no Twig content sandbox, but downgrading is not a recommended security path — validate against the project’s supported branches first.

3. Long-term hardening. Adopt least-privilege content roles so that Twig authoring is a privileged, audited capability. Keep Grav current and monitor the project’s release notes for the 2.0.25 fix. Store secrets outside page-renderable configuration where possible, and segment the CMS so that compromised configuration cannot be reused directly against mail, cache, and identity providers. Implement the detection rules above to monitor for attempts to invoke array against the grav global in request bodies.

References

• NVD — CVE-2026-100668: https://nvd.nist.gov/vuln/detail/CVE-2026-100668
• Grav project releases and security notes: https://github.com/getgrav/grav/releases
• Grav CMS documentation: https://learn.getgrav.org/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html

No public PoC, exploit code, Nuclei template, or CISA KEV entry is associated with CVE-2026-100668 as of this writing. No threat actor campaigns or exploit-in-the-wild evidence have been observed in the provided data.