CVE-2026-114657

CVSS 6.9 (medium) · published 2026-10-22

Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.

Weakness: CWE-200

Source: NVD CVE-2026-114657

References

• https://github.com/getgrav/grav/security/advisories/GHSA-c85g-q5w4-ff68
• https://www.vulncheck.com/advisories/grav-2.0.0-before-2.2.5-http-basic-credential-disclosure-via-twig-uri

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.