Live › vulnerability › CVE-2026-114657
Go to dashboardGrav versions from 2.0.0 before 2.2.5 let a page author print the request URI object, which includes the HTTP Basic username and password, into Twig page content. The author can then embed it in an inline style background image so the credentials are sent to an external host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Grav 2.0.0 through 2.2.4 that use HTTP Basic authentication in front of pages, and where some people can write or edit page content. The risk comes from page authors, so sites where only fully trusted editors write content face less exposure. Sites on versions before 2.0.0 or on 2.2.5 and later are not affected by this report.
No product ranges from the sources yet.
bin/grav version or the version shown in the admin panel.uri object or reference PHP_AUTH_USER or PHP_AUTH_PW.2.2.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.
This page as .md · .json · in your agent: get_signal("CVE-2026-114657")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.