{"id":"CVE-2026-109315","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-109315","generatedAt":"2026-10-27T23:50:20.480Z","title":"Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token.","description":"Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.","published":"2026-10-12T17:17:26.000Z","lastModified":"2026-10-13T19:18:32.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":7.1,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-200"],"affected":[],"epss":{"score":0.00298,"percentile":0.22319,"date":"2026-10-26","history":[{"date":"2026-10-13","score":0.00298,"percentile":0.20853}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-12T17:17:26.000Z","detail":{"score":"7.1","severity":"HIGH","publishedAt":"2026-10-12T17:17:26.340Z"},"summary":"New CVE, high severity (CVSS 7.1)."}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-5qv7-9gjc-4vfh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-2.0.22-before-2.1.7-clockwork-debugger-token-disclosure-via-twig-sandbox","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109315","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}