CVE-2026-109315

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109315

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109315.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109315

Aliases

GHSA-5qv7-9gjc-4vfh

Published

2026-10-12T16:05:09Z

Modified

2026-10-16T02:47:55Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

Details

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109315.json"
}

References

Affected packages

Git / github.com/getgrav/grav

Affected ranges

Type

GIT

Repo

https://github.com/getgrav/grav

Events

Introduced

bc216085962fb14054b0a8ad4a4e56906994fc4b

Fixed

c4e8e47043fa0b1ab30cee554f54da0d458b15ac

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.0.22"
        },
        {
            "fixed":  "2.1.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

2.*

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109315.json"