CVE-2026-114657
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
54/100
Published: 2026-10-22
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Passive
AT:
None
VC:
High
VI:
None
VA:
None
Description
Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.