CVE-2026-109315: Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.1.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs page-editor privileges and the ability to use editor-authored Twig content. The attack is network-reachable, but it is not exploitable by an unauthenticated user based on the available information.
What information can be accessed after obtaining the token?
The disclosed Clockwork debugger token can be supplied in the X-Clockwork-Auth header to access profiler records. Those records may include configuration, request metadata, and database queries.
Which installations are affected?
Grav versions from 2.0.22 before 2.1.7 are affected. Version 2.1.7 is not included in the affected range.
How can administrators check for exposure?
Review whether users with page-editor access can create Twig-rendered content, and determine whether such content has been used to output system.debugger.token. Also review Clockwork profiler access and requests carrying the X-Clockwork-Auth header.