high7.5
CVE-2026-109325
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values.
Impact
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
Affected products
| Product | Affected versions |
|---|---|
| Grav From 2.0.22 | before 2.1.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.