CVE-2026-109315

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-200

Impact

Authenticated page editors can extract the Clockwork debugger token via Twig templates to view sensitive profiler records, including configuration values, request metadata, and database queries. They only need standard page-editing permissions to exploit this.

Root cause

The Twig sandbox redaction list omits system.debugger.token, allowing templates to render the Clockwork authentication secret.

Affected systems

Grav 2.0.22 before 2.1.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Grav to version 2.1.7 or later. If upgrading must wait, disable the Clockwork debugger in system.yaml under debugger.enabled.

shell

$ bin/gpm self-upgrade

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109315