{"id":"CVE-2026-114657","kind":"vulnerability","aliases":["CVE-2026-114657"],"related":[],"title":"Grav CMS: page authors can capture visitors' HTTP Basic credentials","description":"Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.","summary":"Grav versions from 2.0.0 before 2.2.5 let a page author print the request URI object, which includes the HTTP Basic username and password, into Twig page content. The author can then embed it in an inline style background image so the credentials are sent to an external host.","severity":"medium","cvss":6.9,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","grav","php","runtime","self-hosted"],"not_affected_if":["default-config","single-trusted-author"],"how_to_check":"- Check the installed Grav version with `bin/grav version` or the version shown in the admin panel.\n- Look for pages or Twig templates that output the request `uri` object or reference `PHP_AUTH_USER` or `PHP_AUTH_PW`.\n- Check whether the site is protected with HTTP Basic authentication, since the flaw only exposes those credentials.","fix":"- Upgrade Grav to `2.2.5` or later.\n- Until the upgrade is done, review page content from authors you do not fully trust for Twig output of the request URI.\n- Rotate any HTTP Basic passwords that visitors or administrators may have used on the site.","status":"open","published_at":"2026-10-22T02:16:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:38:59+00:00","updated_at":"2026-10-25T03:38:59+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:38:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Grav to `2.2.5` or later.\n- Until the upgrade is done, review page content from authors you do not fully trust for Twig output of the request URI.\n- Rotate any HTTP Basic passwords that visitors or administrators may have used on the site.","reach":"internet","title":"Grav CMS: page authors can capture visitors' HTTP Basic credentials","impact":"medium","summary":"Grav versions from 2.0.0 before 2.2.5 let a page author print the request URI object, which includes the HTTP Basic username and password, into Twig page content. The author can then embed it in an inline style background image so the credentials are sent to an external host.","category":"runtime","nicknames":[],"who_cares":["grav","php","self-hosted","cms"],"confidence":0.7,"needs_auth":"yes","worst_case":"Admin HTTP Basic usernames and passwords are sent to an external host.","analyst_note":"Confirm the exact affected version range and whether HTTP Basic auth is required for exploitation, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114657 and the Grav release notes.","how_to_check":"- Check the installed Grav version with `bin/grav version` or the version shown in the admin panel.\n- Look for pages or Twig templates that output the request `uri` object or reference `PHP_AUTH_USER` or `PHP_AUTH_PW`.\n- Check whether the site is protected with HTTP Basic authentication, since the flaw only exposes those credentials.","needs_analyst":true,"not_affected_if":["default-config","single-trusted-author"],"who_is_affected":"Sites running Grav 2.0.0 through 2.2.4 that use HTTP Basic authentication in front of pages, and where some people can write or edit page content. The risk comes from page authors, so sites where only fully trusted editors write content face less exposure. Sites on versions before 2.0.0 or on 2.2.5 and later are not affected by this report.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":3391,"output_tokens":725,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114657':13A,16A '-2026':12A,15A '2.0.0':27B,74C '2.2.5':29B,76C 'administr':120C 'allow':83C 'auth':106C,110C 'author':4A,33B,52B,85C,96C 'background':61B,116C 'basic':9A,43B,90C 'captur':6A,87C 'cms':2A,17B 'contain':77C 'content':50B,95C 'credenti':10A,65B,91C,121C 'cve':11A,14A 'disclosur':80C 'emb':55B,104C 'exfiltr':119C 'extern':70B,124C 'grav':1A,18B,24B,72C 'host':23B,71B,125C 'http':8A,42B,89C 'imag':62B,117C 'includ':40B 'inform':79C 'inlin':59B,114C 'insid':112C 'let':30B 'object':38B,102C 'page':3A,32B,49B,84C,94C 'password':46B 'php':19B,105C,109C 'print':34B,98C 'pw':111C 'request':36B,100C 'runtim':20B 'self':22B 'self-host':21B 'sent':67B 'style':60B,115C 'twig':48B,93C 'uri':37B,101C 'user':107C 'usernam':44B 'version':25B 'visitor':7A,88C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running Grav 2.0.0 through 2.2.4 that use HTTP Basic authentication in front of pages, and where some people can write or edit page content. The risk comes from page authors, so sites where only fully trusted editors write content face less exposure. Sites on versions before 2.0.0 or on 2.2.5 and later are not affected by this report.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114657","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114657","severity":null,"published_at":"2026-10-22T02:16:57+00:00","modified_at":"2026-10-22T02:16:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114657","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114657","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}