{"id":"CVE-2026-110889","kind":"vulnerability","aliases":["CVE-2026-110889"],"related":[],"title":"Gantry 5 Framework: error messages leak sensitive data to visitors","description":"Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.","summary":"Gantry 5 Framework, a theme framework for Joomla and WordPress sites, generates error messages that contain sensitive information. The NVD entry says an attacker can retrieve embedded sensitive data from those messages.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gantry5","joomla","runtime","self-hosted","wordpress"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Gantry 5 Framework version against the affected range in the NVD entry (through `5.6.4`)\n- unknown for other checks, the sources do not say which configuration exposes the error output","fix":"- Upgrade Gantry 5 Framework to a version later than `5.6.4`\n- unknown for a specific patched version, the sources do not say","status":"open","published_at":"2026-10-17T11:16:32+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:23:38+00:00","updated_at":"2026-10-25T03:23:38+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T03:23:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Gantry 5 Framework to a version later than `5.6.4`\n- unknown for a specific patched version, the sources do not say","reach":"internet","title":"Gantry 5 Framework: error messages leak sensitive data to visitors","impact":"medium","summary":"Gantry 5 Framework, a theme framework for Joomla and WordPress sites, generates error messages that contain sensitive information. The NVD entry says an attacker can retrieve embedded sensitive data from those messages.","category":"runtime","nicknames":[],"who_cares":["gantry5","joomla","wordpress","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive data embedded in error messages is readable by remote visitors","analyst_note":"Confirm which error paths leak data, the exact patched version, and the CVSS vector; the NVD page linked in the sources is the starting point.","how_to_check":"- Check the installed Gantry 5 Framework version against the affected range in the NVD entry (through `5.6.4`)\n- unknown for other checks, the sources do not say which configuration exposes the error output","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running Gantry 5 Framework up to and including `5.6.4`. The sources do not say which error conditions expose the data or whether any non-default setting is needed, so the exposed surface is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000598,"input_tokens":3312,"output_tokens":533,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110889':13A,16A '-2026':12A,15A '5':2A,25B,67C,78C '5.6.4':83C 'affect':76C 'allow':70C 'attack':47B 'contain':39B,60C 'cve':11A,14A 'data':8A,52B 'data.this':74C 'embed':50B,72C 'entri':44B 'error':4A,36B,58C 'framework':3A,26B,29B,68C,79C 'gantri':1A,24B,65C,66C,77C 'gantry5':17B,69C 'generat':35B,56C 'host':22B 'inform':41B,62C 'issu':75C 'joomla':18B,31B 'leak':6A 'messag':5A,37B,55B,59C 'n/a':81C 'nvd':43B 'retriev':49B,71C 'runtim':19B 'say':45B 'self':21B 'self-host':20B 'sensit':7A,40B,51B,61C,73C 'site':34B 'theme':28B 'visitor':10A 'vulner':63C 'wordpress':23B,33B","nicknames":[],"mitigations":[],"who_affected":"Sites running Gantry 5 Framework up to and including `5.6.4`. The sources do not say which error conditions expose the data or whether any non-default setting is needed, so the exposed surface is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T11:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110889","severity":null,"published_at":"2026-10-17T11:16:32+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}