---
id: "CVE-2026-114657"
kind: "vulnerability"
aliases: ["CVE-2026-114657"]
title: "Grav CMS: page authors can capture visitors' HTTP Basic credentials"
severity: "medium"
cvss: 6.9
epss: 0.00217
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cms", "grav", "php", "runtime", "self-hosted"]
not_affected_if: ["default-config", "single-trusted-author"]
published_at: "2026-10-22T02:16:57+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:38:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114657", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114657", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Grav CMS: page authors can capture visitors' HTTP Basic credentials

Grav versions from 2.0.0 before 2.2.5 let a page author print the request URI object, which includes the HTTP Basic username and password, into Twig page content. The author can then embed it in an inline style background image so the credentials are sent to an external host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Grav version with `bin/grav version` or the version shown in the admin panel.
- Look for pages or Twig templates that output the request `uri` object or reference `PHP_AUTH_USER` or `PHP_AUTH_PW`.
- Check whether the site is protected with HTTP Basic authentication, since the flaw only exposes those credentials.

## Fix

- Upgrade Grav to `2.2.5` or later.
- Until the upgrade is done, review page content from authors you do not fully trust for Twig output of the request URI.
- Rotate any HTTP Basic passwords that visitors or administrators may have used on the site.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114657
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114657

## From the sources

Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_