VulnSocial

CVE-2026-42610Disclosure(getgrav / grav)

LOWCVSS 6.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt. This vulnerability is fixed in 2.0.0-beta.2.

getgrav CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • grav

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
getgrav
Products
grav

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-05-11: 3Technical Details · 2026-05-11: 205-11
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets4 URLs
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-42610 Twig Sandbox Bypass in Grav Prior to 2.0.0-beta.2 Allows Data Ext... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42610 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The post shares a link to the official vulnerability listing for CVE‑2026‑42610, indicating a Twig sandbox bypass in Grav, but provides no proof‑of‑concept, exploit code, patch, or active exploitation information.

    0000043
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-42610 Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig s… https://www.cve.org/CVERecord?id=CVE-2026-42610 ----- Traducción: CVE-2026-42610 Gra… http://infoflow.cloud`

    Post summary

    The message announces CVE‑2026‑42610 and indicates a privilege‑bypass issue in Grav before v2.0.0‑beta.2, but it supplies no detailed technical data, PoC, exploit code, patch, or evidence of active exploitation.

    0000032
    77 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-42610 Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig s… https://www.cve.org/CVERecord?id=CVE-2026-42610

    Post summary

    The passage announces a privilege bypass vulnerability in Grav (pre-2.0.0-beta.2), describing the impact but offering no PoC, exploit, or patch details.

    00000111
    57.5K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appgetgravgrav---
Appgetgravgrav2.0.0--

Explore more

Back to dashboardgetgrav CVEsgrav vulnerabilities