Information Disclosure in Grav Product by Getgrav

CVE-2026-109315

What is CVE-2026-109315?

An information disclosure vulnerability in Grav versions prior to 2.1.7 allows page editors to access sensitive Clockwork debugger tokens. The issue arises from an inadequate redaction list in the Twig sandbox, which fails to include the system.debugger.token entry. As a result, attackers can potentially utilize editor-generated Twig templates to extract this token and issue it through the X-Clockwork-Auth header, enabling them to gain unauthorized access to sensitive profiler records. This includes access to configuration details, request metadata, and database queries, posing significant risks to the security of the affected system.

References