CVE-2026-61454

MEDIUM

Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

Title source: cna
STIX 2.1

Description

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-pfjq-chp8-3vgh)
https://github.com/getgrav/grav/security/advisories/GHSA-pfjq-chp8-3vgh
Third Party Advisory third-party-advisory
VulnCheck Advisory: Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-grav-config

Scores

CVSS v3 5.3
EPSS 0.0024
EPSS Percentile 15.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
getgrav/grav < 2.0.4
getgrav/grav 2.0.4
Published Jul 11, 2026
Tracked Since Jul 11, 2026