CVE-2026-76846

## Summary `system/config/security.yaml`'s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `security`, `backups`, `scheduler`) omits the `system` prefix. When an operator enables the documented, non-default `twig_content.config_access: true` setting (intended to safely expose low-sensitivity values like `site.title` to editor-authored Twig content), any real secret stored under `system.*` , for example `system.cache.redis.password` , is also exposed, both via `config.get(...)` and via `config.toArray()`, to any user with page-edit permission. This is a follow-up gap in the fix for GHSA-j274-39qw-32c9 (config.toArray() secret exfiltration): that fix correctly introduced a `SandboxConfig` facade with a denylist, but the shipped default denylist is incomplete. ## Environment used to verify - Grav commit at HEAD of the default branch, `GRAV_VERSION` `2.0.15` - PHP 8.3.6 with curl, zip, dom, gd extensions installed - Full `composer install --no-dev` run against the real repository (no mocked dependencies) so the actual `Grav\Common\Config\Config` and `Grav\Common\Twig\Sandbox\SandboxConfig` classes could be exercised directly ## Commands run to set up the verification environment ```bash git clone https://github.com/getgrav/grav.git cd grav # install missing PHP extensions required by composer.json apt-get install -y php8.3-curl php8.3-zip php8.3-xml php8.3-gd # composer.phar fetched directly from GitHub releases curl -sL -o /tmp/composer.phar \ "https://github.com/composer/composer/releases/latest/download/composer.phar" COMPOSER_ALLOW_SUPERUSER=1 php /tmp/composer.phar install --no-dev --no-interaction ``` ## Proof of Concept Confirmed the real, currently-shipped config field first, rather than assuming one: ```bash grep -n "redis" -A3 system/config/system.yaml # redis: # socket: false # password: # <- system.cache.redis.password, a real field # database: grep -n "cache.redis.password" -A6 system/bl