CVE-2026-109315 getgrav CVE debrief

Who should care

Page editors, developers, and Grav administrators should be aware of this vulnerability. They should verify sandbox configurations, restrict Twig access, and monitor for suspicious activity related to Clockwork debugger tokens. Additionally, they should review and update Grav to version 2.1.7 or later, and restrict access to Twig for non-editor roles.

Why it matters

CVE-2026-109315 allows page editors to disclose Clockwork debugger tokens via Twig Sandbox in Grav 2.0.22 before 2.1.7. Defenders should verify sandbox configurations, restrict Twig access, and monitor for suspicious activity.

• Verify sandbox configurations to prevent token disclosure
• Restrict Twig access to prevent unauthorized token usage
• Monitor for suspicious activity related to Clockwork debugger tokens

Technical summary

Grav 2.0.22 before 2.1.7 allows page editors to read Clockwork debugger tokens via Twig Sandbox. The sandbox redaction list omits system.debugger.token, enabling attackers to render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries. Defenders should focus on restricting Twig access and verifying sandbox configurations to mitigate this vulnerability. The vulnerability is a result of the sandbox not properly redacting sensitive information, allowing for potential unauthorized access to sensitive data.

Defensive priority

Page editors with access to Twig should verify sandbox configurations.

Recommended defensive actions

• Review and update Grav to version 2.1.7 or later
• Restrict access to Twig for non-editor roles
• Monitor for suspicious Twig usage
• Verify sandbox configurations to prevent token disclosure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE and NVD records detail Grav's Clockwork debugger token disclosure via Twig Sandbox. The CVE record was published on 2026-10-12T16:05:09.498Z and has not been modified since then. The vulnerability is confirmed to exist in Grav versions 2.0.22 before 2.1.7. There are no known exploits or additional details beyond the official records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.