A critical information disclosure vulnerability in the Grav Twig sandbox allows unauthenticated remote attackers to gain unauthorized access to sensitive system information.

This vulnerability (CWE-522) involves insufficient protection of credentials or sensitive data within the Twig templating environment. Unauthenticated remote attackers can exploit this to bypass sandbox restrictions and retrieve information that should otherwise be inaccessible to them.

Successful exploitation results in the unauthorized disclosure of sensitive configuration data or user information stored within the Grav environment. This information can be leveraged to escalate privileges, facilitate further attacks, or compromise the underlying server infrastructure. Given the 7.5 CVSS score, this represents a significant threat to data privacy and system integrity.

Immediate Action: Update the Grav installation to version 2.0.16 or later, which includes the necessary security fixes for the Twig sandbox.

Proactive Monitoring: Audit access logs for unusual requests directed at template rendering functions or unexpected access to configuration-related files.

Compensating Controls: Ensure that the production environment follows the principle of least privilege, restricting file system access for the web server user to prevent the leakage of sensitive environment files.

Public Exploit Available: No (exploit_available: false)

Information disclosure flaws in core templating engines can have wide-reaching consequences for application security. It is imperative to apply the provided update to version 2.0.16 to secure the Twig sandbox and prevent unauthorized data retrieval by unauthenticated actors.