CVE-2026-109315
Deferred Deferred - Pending Action

Grav CMS Information Disclosure via Debugger Token

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109315
EUVD
EUVD-2026-97617

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav 2.0.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Grav CMS versions 2.0.22 to 2.1.7 allows page editors to access sensitive debugging information. The issue occurs because the system's security sandbox fails to redact the Clockwork debugger token, enabling attackers to view profiler records containing configuration details, request metadata, and database queries by rendering the token through Twig and using it in an HTTP header.

Detection Guidance

Check Grav version with 'bin/grav version' in the Grav installation directory. If version is between 2.0.22 and 2.1.7, the system is vulnerable. Look for unauthorized access to Clockwork debugger tokens in application logs or profiler records.

Impact Analysis

If you are a Grav CMS user with page editor privileges, an attacker could exploit this to steal sensitive data like database queries, configuration settings, or user requests. This could lead to further attacks such as data breaches, unauthorized access, or system compromise depending on the exposed information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could trigger fines or penalties under these regulations.

Mitigation Strategies

Upgrade Grav to version 2.1.7 or later immediately. Review and remove any unauthorized access to profiler records or configuration data. Monitor for suspicious activity related to debugger tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109315. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart