CVE-2026-109325

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109325

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109325.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109325

Aliases

GHSA-v8fx-pc9p-934x

Published

2026-10-12T16:05:16Z

Modified

2026-10-16T02:47:28Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

Details

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109325.json"
}

References

Affected packages

Git / github.com/getgrav/grav

Affected ranges

Type

GIT

Repo

https://github.com/getgrav/grav

Events

Introduced

bc216085962fb14054b0a8ad4a4e56906994fc4b

Fixed

c4e8e47043fa0b1ab30cee554f54da0d458b15ac

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.0.22"
        },
        {
            "fixed":  "2.1.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

2.*

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109325.json"