Grav: config_denied_paths default list omits system, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Packagist getgrav/grav · Upgrade to 2.0.16 or later · <= 2.0.15 · CVE-2026-76846 · GHSA-xjw5-q542-3vmr · amended