CVE-2026-109315: Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

Q: Who can exploit this issue?

An attacker needs page-editor privileges and the ability to use editor-authored Twig content. The attack is network-reachable, but it is not exploitable by an unauthenticated user based on the available information.

Q: What information can be accessed after obtaining the token?

The disclosed Clockwork debugger token can be supplied in the X-Clockwork-Auth header to access profiler records. Those records may include configuration, request metadata, and database queries.

Q: Which installations are affected?

Grav versions from 2.0.22 before 2.1.7 are affected. Version 2.1.7 is not included in the affected range.

Q: How can administrators check for exposure?

Review whether users with page-editor access can create Twig-rendered content, and determine whether such content has been used to output system.debugger.token. Also review Clockwork profiler access and requests carrying the X-Clockwork-Auth header.

Published Oct 12, 2026

Updated

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.

Affected Software

1 affected component

Grav Grav>=2.0.22<2.1.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav to a version that resolves this vulnerability.
Fixed in 2.1.7

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs page-editor privileges and the ability to use editor-authored Twig content. The attack is network-reachable, but it is not exploitable by an unauthenticated user based on the available information.

What information can be accessed after obtaining the token?

The disclosed Clockwork debugger token can be supplied in the X-Clockwork-Auth header to access profiler records. Those records may include configuration, request metadata, and database queries.

Which installations are affected?

Grav versions from 2.0.22 before 2.1.7 are affected. Version 2.1.7 is not included in the affected range.

How can administrators check for exposure?

Review whether users with page-editor access can create Twig-rendered content, and determine whether such content has been used to output system.debugger.token. Also review Clockwork profiler access and requests carrying the X-Clockwork-Auth header.

CVE-2026-109315: Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be accessed after obtaining the token?

Which installations are affected?

How can administrators check for exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be accessed after obtaining the token?

Which installations are affected?

How can administrators check for exposure?