CVE-2026-100671

Executive Summary

CVE-2026-100671 is a session-cookie disclosure vulnerability in the Grav flat-file CMS caused by unsafe Twig sandbox exposure of get_cookie() combined with an identity-blind page-content cache. A low-privileged user with page-write permission can author a page whose rendered output captures the session cookie of the next administrator who views it, and that cached output is then served to unauthenticated visitors, who can replay the stolen cookie to authenticate as that administrator. All deployments running Grav 2.0.0 through 2.0.24 are affected — with 2.0.19 through 2.0.24 vulnerable by default — and the issue is unpatched as of this report (fixed only in 2.0.25).

Technical Analysis

CVE-2026-100671 has three interacting root causes, all derived from the NVD description.

First, a Twig sandbox allowlist gap. Page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(). This function returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure, and SameSite attributes of the cookie offer no protection — those attributes govern browser-side script access and transport/site scoping, not server-side reads of the inbound request. The sandbox restriction that normally limits what a page author can invoke therefore does not prevent credential-adjacent data access.

Second, a session-blind cache. Grav stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum. The cache key has no session, user, or request dimension and no bypass for authenticated visitors. Consequently, the rendered page produced during an administrator's visit — containing that administrator's session identifier — is stored and reused for other visitors. This turns a per-request disclosure into a persistent, shared data leak.

Third, a configuration default change that widens exposure. Since 2.0.19, security.twig_content.process_enabled defaults to true, and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate. This means content Twig runs on every page with no frontmatter or operator action required, converting the sandbox gap from an opt-in risk into the default state for 2.0.19 through 2.0.24. Versions 2.0.0 through 2.0.18 and 1.7.x are affected only where content Twig has been explicitly enabled. The vulnerability class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), realized here as authentication material disclosure through cached server-side template output.

The attack surface is the CMS page-authoring and page-rendering pipeline: a page-write principal as the input channel, the Twig sandbox as the enforcement boundary, and the page-content cache as the distribution channel to unauthenticated clients.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description only.

1. Reconnaissance/target identification. An adversary obtains or already holds an account with only page-write permission — for example, a low-privilege editor or contributor on a Grav site. They identify that the installation runs a version in the affected range (2.0.19–2.0.24 by default, or 2.0.0–2.0.18 / 1.7.x with content Twig explicitly enabled). No public exploit code exists, so execution depends on the ability to author page content that invokes allowlisted Twig functions.

2. Triggering the flaw class. The page-write user authors page content that, when rendered through the Twig sandbox, invokes the allowlisted get_cookie() function so that the page's rendered output emits the current request's cookie value, including the session cookie. Because the sandbox permit-lists get_cookie(), the author does not need to escape the sandbox; the disclosure is a sanctioned capability being applied to sensitive data.

3. Capture and caching. An administrator who subsequently views the published page has their session cookie read server-side via filter_input(INPUT_COOKIE, ...) and embedded in the post-Twig output. Grav writes that finished output to the page-content cache, keyed only on page identity and configuration checksum — with no session, user, or request component. The administrator's session identifier is now resident in a shared cache entry.

4. Post-exploitation. The cached page is served to unauthenticated visitors, who receive the administrator's session identifier in the outgoing response. Those visitors can replay the stolen cookie to authenticate as that administrator. Successful replay yields administrative session access (per CVSS, high confidentiality, integrity, and availability impact), enabling account takeover of the CMS.

Impact Assessment

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base score 8.0. Attack Vector is Network (AV:N); Attack Complexity is Low (AC:L), as the flaw relies on an allowlisted function and the default configuration rather than a race or exotic precondition; Privileges Required is Low (PR:L), matching the page-write permission needed to author content; User Interaction is Required (UI:R), because an administrator must view the poisoned page to seed the cache with their session identifier; Scope is Unchanged (S:U); and Confidentiality, Integrity, and Availability impacts are each High (C:H/I:H/A:H), since a replayed administrative session can read, alter, and disrupt the managed site.

Business impact is significant wherever Grav is used as an internet-facing CMS with multiple users of differing privilege. Any operator who grants page-write permission to contributors — a common editorial workflow — extends the attack surface directly. The blast radius includes all visitors of the poisoned page, because the cache serves the captured identifier to unauthenticated clients until the cache entry is invalidated; the identifier may be harvested by the first unauthenticated requester rather than the original author. Sites relying on Grav in a flat-file model without a separate WAF or edge cache that strips cookies from cached responses face the full impact. The EPSS score is not yet published by FIRST.org, and the CVE is not listed in CISA KEV, so no exploitation-in-the-wild telemetry is currently authoritative.

Detection Guidance

Sigma Rule

title: Grav Page Content Cache Serving Session Cookie to Unauthenticated Visitors
id: 7f3c1a92-4b6e-4d21-9c8a-1e5d0a6f2b74
status: experimental
description: Detects Grav CMS page responses returned to unauthenticated clients that carry a Set-Cookie session identifier or a GravSession value in the body, indicating a poisoned page-content cache (CVE-2026-100671).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100671
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-method: 'GET'
  selection_grav:
    cs-uri-query|contains: '/'
  selection_cookie_leak:
    sc-status: 200
    cs-cookie|contains:
      - 'grav-site'
      - 'GravSession'
  condition: selection_path and selection_grav and selection_cookie_leak
fields:
  - c-ip
  - cs-uri-stem
  - cs-cookie
  - sc-status
falsepositives:
  - Legitimate cookie-setting endpoints on Grav pages
  - Misconfigured reverse proxies that reflect inbound cookies
level: high
tags:
  - attack.t1190
  - cve.2026.100671

YARA Rule

rule CVE_2026_100671_Grav_Twig_Cookie_Cache
{
    meta:
        author = "valtersit.com"
        description = "Detects Grav page-content cache entries (and cached HTML) containing a Twig get_cookie invocation or a captured session identifier in post-Twig output. CVE-2026-100671."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100671"
        date = "2026-01-01"
        severity = "high"
    strings:
        $twig_cookie = "get_cookie(" nocase
        $twig_cookie2 = "get_cookie" nocase
        $grav_session = "GravSession" nocase
        $process_twig = "process:" ascii
        $twig_frontmatter = "twig:" ascii
    condition:
        uint32(0) != 0x504b0304 and
        (
            (any of ($twig_cookie*)) or
            ($grav_session and $twig_frontmatter) or
            ($grav_session and $process_twig)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100671 Grav CMS cached session cookie disclosure to unauthenticated client"; flow:established,to_client; http.method; content:"GET"; http.stat_code; content:"200"; http.header; content:"Set-Cookie"; content:"GravSession"; nocase; classtype:attempted-user; reference:cve,2026-100671; sid:2026100671; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "GET" and not http.request.headers contains "Cookie"]
  [http where http.response.status_code == 200 and http.response.headers contains "GravSession"]

Splunk SPL Query

index=web sourcetype=access_combined
| search cs_method=GET
| eval cookie_leak=if(match(_raw,"(?i)(grav-site|GravSession)"), 1, 0)
| eval unauth=if(NOT match(_raw,"(?i)Cookie:"), 1, 0)
| where cookie_leak=1
| stats count values(uri_path) as poisoned_pages by clientip, cookie_leak, unauth
| where unauth=1
| sort - count

Wazuh OSSEC Rule

<group name="web,grav,cve-2026-100671,">
  <rule id="100671" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="method">GET</field>
    <match>GravSession|grav-site</match>
    <description>CVE-2026-100671 - Grav CMS response to unauthenticated client contains session cookie indicator (possible poisoned page-content cache)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100671,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vulnerability is reported fixed in Grav 2.0.25; 1.7.x is outside the backport scope. No vendor-published workarounds are available in the data provided.

1. Immediate mitigations.

• Until 2.0.25 is deployed, disable content Twig processing. Because security.twig_content.process_enabled defaults to true since 2.0.19, explicitly set it to false so Security::applyTwigContentDefault() no longer derives per-page process.twig as enabled.
• Restrict or temporarily suspend page-write permissions for untrusted or contributor accounts on internet-facing instances.
• Configure the reverse proxy or CDN to strip cookies from cacheable responses and to avoid caching authenticated responses, reducing the window in which a poisoned page-content cache is served to other clients.
• Invalidate the page-content cache after any suspected page authored by a low-privileged user, and after remediation, to evict any captured session identifiers.
• Rotate administrator credentials and session identifiers for any administrator who viewed untrusted page content, since captured cookies may still be replayable.

2. Patch/upgrade steps.

• Upgrade Grav to 2.0.25 or later. There is no backport for 1.7.x, so 1.7.x operators must either upgrade to a fixed 2.0.x release or disable content Twig explicitly.
• After upgrade, clear the page-content cache so stale rendered output cannot be replayed.
• Re-validate that content Twig is configured as intended and that no page retains an unsafe process.twig frontmatter flag.

3. Long-term hardening.

• Adopt a default-deny posture for CMS sandbox allowlists: do not expose functions that read request state (such as cookies) to page authors.
• Ensure cache keys include an identity/session dimension for any output derived from authenticated request data, and never store per-user data in shared cache entries.
• Enforce least privilege for page-write roles and review who can publish.
• Keep Grav and its Twig sandbox configuration under change control; treat changes to Twig processing defaults as security-relevant.
• Monitor access and application logs for the detection patterns above and alert on cookie leakage to unauthenticated clients.

References

• NVD — CVE-2026-100671: https://nvd.nist.gov/vuln/detail/CVE-2026-100671
• Grav project (vendor) — official release and security advisories: https://github.com/getgrav/grav
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• FIRST EPSS — not yet scored for this CVE (do not assume a value): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-100671 is NOT listed (as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code is available, and there is no confirmed exploit-in-the-wild or named threat-actor campaign associated with CVE-2026-100671 in the provided data.