Getgrav
CVE-2026-109315: Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox
CVE-2026-109315 Oct 12, 2026 Source: Vendor
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-109315
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2
CVE-2026-109315
BR2026-0000-026859
unclaimed
Credited as manus-pi
CVE-2026-109315
BR2026-0000-026860
unclaimed
Credited as manus-use