CVE-2026-109315

Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

State: Published
Severity: 7.1 High
Published: Oct 12, 2026
Updated: Oct 13, 2026
Reserved: Oct 12, 2026

Description

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
gravgetgrav	2.0.22 to before 2.1.7Affected 2.1.7Not affected

References

GitHub Security Advisory (GHSA-5qv7-9gjc-4vfh)vendor-advisory
VulnCheck Advisory: Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandboxthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.