4 matches found
CVE-2026-109315
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Aut...
EUVD-2026-97617
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Aut...
CVE-2026-109315
The Grav CMS (versions 2.0.22 before 2.1.7 ) is susceptible to an information disclosure vulnerability due to an oversight in the Twig sandbox redaction list, which omits system.debugger.token . This allows page editors to render the Clockwork debugger token through editor-authored Twig. An attac...
CVE-2026-109315 Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Aut...