CVE-2026-100671 — Getgrav
HIGHCVE-2026-100671 is a high-severity (CVSS 8) Information Exposure vulnerability. No vendor fix is recorded yet; mitigation options are listed below.
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user…
Description
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`). Because exploitation targets the running service rather than your application code, O3 also flags the exploit behaviour from runtime telemetry and egress traffic.
Remediation status
No fixed release is recorded for CVE-2026-100671 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. O3's runtime protection blocks the information exposure flaw at execution, which holds the line on hosts you cannot patch immediately.
How O3 protects you
O3 detects and blocks CVE-2026-100671 exploitation at runtime with eBPF exploit-chain detection, plus L7 egress monitoring that catches a post-exploitation callback and cuts the attacker's outbound channel.
Tailored to CVE-2026-100671. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-100671 in your dependencies?
O3 Security finds CVE-2026-100671 across dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.