Is CVE-2026-109315 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109315 being exploited in the wild.

How severe is CVE-2026-109315?

Medium severity, with a CVSS score of 6.5, published 12 October 2026.

Is there a fix for CVE-2026-109315?

Yes: fixed in 2.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109315 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109315?

Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109315: Grav information disclosure in Clockwork debugger token via Twig sandbox

CVE-2026-109315 · Severity: medium · CVSS 6.5 · Published 2026-10-12

Grav is a flat-file content management system used to build websites without a database. A vulnerability allows users with page editor permissions to extract the Clockwork debugger authentication token from the system configuration, which can then be used to read sensitive profiler data including database queries, configuration settings, and request metadata—effectively elevating an editor's access to system-level information.

Technologies: Grav. Vendors: Grav.

Quick answers

Is CVE-2026-109315 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109315 being exploited in the wild.
How severe is CVE-2026-109315?: Medium severity, with a CVSS score of 6.5, published 12 October 2026.
Which products and versions are affected?: Grav 2.0.22 through 2.1.6.
Is there a fix for CVE-2026-109315?: Yes: fixed in 2.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109315 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109315?: Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.1.7

Technical details

The vulnerability is an information disclosure (CWE-200) caused by incomplete sandbox redaction in Grav's Twig templating engine. The sandbox filtering omits system.debugger.token from its redaction list, allowing authenticated page editors to render the token via Twig and use it as an X-Clockwork-Auth header to access Clockwork profiler records. This requires editor-level permissions but no further user interaction.

Affected products

Grav Grav 2.0.22 through 2.1.6

Timeline

2026-09-23: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.