What’s Vulnerable › Vulnerabilities

CVE-2026-109315: Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-200

Description

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.

Affected products

• getgrav grav: from 2.0.22 before 2.1.7 — fixed in 2.1.7

How to fix

Upgrade to a fixed version: getgrav grav 2.1.7. Check the vendor advisory for mitigations.

References

• https://github.com/getgrav/grav/security/advisories/GHSA-5qv7-9gjc-4vfh
• https://www.vulncheck.com/advisories/grav-2.0.22-before-2.1.7-clockwork-debugger-token-disclosure-via-twig-sandbox

Get alerted when CVE-2026-109315 or the next vulnerability affects your stack