CVE-2026-109315

Executive Summary

CVE-2026-109315 is an information disclosure vulnerability in the Grav flat-file CMS affecting versions from 2.0.22 before 2.1.7. The flaw allows an authenticated user with page editor privileges to read the Clockwork debugger authentication token because the sandbox redaction list omits system.debugger.token, enabling the editor to render the token via Twig and reuse it as the X-Clockwork-Auth header. Successful exploitation exposes profiler records containing configuration data, request metadata, and database queries, resulting in a high confidentiality impact (CVSS 6.5, C:H/I:N/A:N).

Technical Analysis

Grav is a modern, open-source flat-file content management system written in PHP. The vulnerability resides in the interaction between Grav's Twig-based content templating (used by page editors to author dynamic pages) and the Clockwork debugging/profiling extension, which stores request profiling data and protects access to that data with an authentication token.

The core defect is a missing entry in the sandbox redaction list. Grav applies a sandbox/redaction mechanism to limit what page editors can access from the global configuration when authoring Twig templates. The system configuration key system.debugger.token is not included in the redaction list, meaning an editor-privileged user can reference it from Twig and have its value rendered into page output. Because the redaction list fails to cover this key, the debugger token is exposed to any user who can author or preview page content.

The exposed token is the shared secret used to authorize requests to the Clockwork profiler endpoint via the X-Clockwork-Auth header. Clockwork collects and stores profiling records that include configuration values, request metadata (headers, cookies, session data), and executed database queries. Once the token is obtained, an attacker can supply it as X-Clockwork-Auth to retrieve those profiler records, effectively bypassing the authentication control protecting the debugger data store.

Two conditions elevate exploitability: (1) the vulnerable user only requires low privileges — page editor access (PR:L) — rather than administrative rights, and (2) the attack is network-reachable (AV:N) and requires no user interaction (UI:N). The vulnerability class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a redaction/allowlist failure during content sanitization. Notably, the description does not specify the exact Twig variable path or endpoint format; technical detail beyond the token rendering mechanism and X-Clockwork-Auth header is limited.

Exploitation Scenarios

The following chain is inferred from the vulnerability class and the NVD description. No public PoC or exploit code is available at time of writing.

1. Reconnaissance/target identification. The attacker identifies a Grav instance running a version between 2.0.22 and 2.1.7. Fingerprinting may be performed via HTTP response characteristics, known Grav paths, or page metadata. The attacker must obtain or already possess an authenticated account with page editor privileges.

2. Triggering the flaw. Using editor-authored Twig, the attacker references the system configuration value for the debugger token (system.debugger.token). Because this key is absent from the sandbox redaction list, Grav renders its value into the resulting page output instead of redacting it. The attacker views the rendered page to capture the token.

3. Payload/execution method. With the token in hand, the attacker issues HTTP requests to the Clockwork profiler endpoint, supplying the captured token as the X-Clockwork-Auth header value. This satisfies the profiler's authentication check.

4. Post-exploitation impact. The attacker reads profiler records containing application configuration, request metadata, and database queries. This information disclosure can reveal secrets, internal endpoints, schema details, and query structures, supporting further reconnaissance and potential escalation, though this CVE itself does not provide code execution or data modification (I:N/A:N).

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

The CVSS 3.1 base score is 6.5 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The confidentiality subscore is High (C:H) because profiler records can leak configuration values, request metadata, and database queries — a broad and sensitive dataset. Integrity (I:N) and Availability (A:N) are unaffected, and scope is unchanged (S:U). The attack requires only low privileges (PR:L), is network-reachable (AV:N), and needs no user interaction (UI:N), which lowers the practical barrier.

Business impact centers on information disclosure. Exposed configuration may include credentials, API keys, and internal service details; request metadata may reveal session tokens or customer data; database queries may expose schema and business logic. In a multi-tenant or shared Grav deployment, an editor on one site could potentially access profiler data from the shared Clockwork store. Blast radius depends on the sensitivity of the profiled data and the breadth of configuration captured. The EPSS score is not yet assigned by FIRST.org, so no exploited-in-the-wild probability estimate is available; the defect is not listed in CISA KEV. No public exploit code or Nuclei template was identified, reducing near-term mass-exploitation risk, but the low privilege requirement and absence of a confirmed patch raise the urgency for affected operators.

Detection Guidance

Sigma Rule

title: Grav Clockwork Debugger Token Disclosure via Twig
id: 8f3c2a1e-5b7d-4c9a-9e2f-1a6b0d4c7e31
status: experimental
description: Detects access to Clockwork profiler endpoint using X-Clockwork-Auth header consistent with CVE-2026-109315 token abuse in Grav CMS
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109315
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_header:
    cs-header|contains: 'X-Clockwork-Auth'
  selection_uri:
    cs-uri-stem|contains:
      - '/__clockwork'
      - '/clockwork'
  condition: selection_header and selection_uri
fields:
  - c-ip
  - cs-uri-stem
  - cs-header
falsepositives:
  - Legitimate developer debugging activity on staging systems
level: medium

YARA Rule

rule CVE_2026_109315_Grav_Clockwork_Token_Leak
{
    meta:
        description = "Detects Grav Twig content attempting to access the Clockwork debugger token (system.debugger.token) for CVE-2026-109315"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109315"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $a = "system.debugger.token" ascii wide nocase
        $b = "X-Clockwork-Auth" ascii nocase
        $c = "config.system.debugger" ascii wide nocase
    condition:
        filesize < 2MB and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109315 Grav Clockwork Debugger Token Abuse (X-Clockwork-Auth)"; flow:established,to_server; http.header; content:"X-Clockwork-Auth"; http.uri; content:"clockwork"; nocase; classtype:attempted-recon; reference:cve,2026-109315; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109315; sid:2026109315; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ file where file.path : "*" and process.name : "*" ]
  [ network where http.request.headers contains "X-Clockwork-Auth" and http.request.uri : "*clockwork*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval hdr=coalesce(cs_headers, request_headers)
| where like(hdr, "%X-Clockwork-Auth%") OR like(uri_path, "%clockwork%")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, hdr, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,grav,cve-2026-109315,">
  <rule id="1109315" level="10">
    <if_sid>31100</if_sid>
    <field name="url">clockwork</field>
    <regex>X-Clockwork-Auth</regex>
    <description>CVE-2026-109315: Possible Grav Clockwork debugger token abuse via X-Clockwork-Auth header</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict page editor accounts to fully trusted personnel and audit the editor role assignment. Where possible, disable or restrict the Clockwork debugger in production (system.debugger.enabled and profiler storage) so the token and profiler records are not exposed. Add system.debugger.token to the sandbox redaction list manually if supported. Block external access to the Clockwork profiler endpoint at the reverse proxy/WAF and alert on any request containing the X-Clockwork-Auth header. Rotate the debugger token if exposure is suspected.

2. Patch/upgrade steps. Monitor Grav release channels and the official Grav repository for a fix addressing CVE-2026-109315. No vendor fix is confirmed at time of writing; do not assume any release resolves the flaw until the vendor or a CVE reference states so. Track the NVD entry and Grav GitHub advisory feed for updates.

3. Long-term hardening. Run Grav in production with debugger/profiler components disabled entirely. Enforce least privilege for content roles, separating edit from administrative capabilities. Adopt a deny-by-default redaction model for system configuration exposed to templating. Deploy egress and header-based WAF rules for debugger endpoints and review configuration for other omitted sensitive keys.

References

• NVD — CVE-2026-109315: https://nvd.nist.gov/vuln/detail/CVE-2026-109315
• MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• MITRE CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• Grav CMS official project/advisory channel: https://github.com/getgrav/grav
• FIRST EPSS (score pending at time of writing): https://www.first.org/epss/

No CISA KEV listing, no public exploit code, no Nuclei template, and no confirmed threat actor campaign or exploit-in-the-wild evidence was identified for this CVE.