CVE-2026-109325: getgrav grav, изтичане на данни

Описание

Оригинално описание

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

Засегнати продукти

• getgrav grav: 2.0.22 преди 2.1.7; 2.1.7

Вид слабост

• CWE-200 Разкриване на чувствителна информация пред неоторизирана страна

История

Други уязвимости в getgrav grav

• 8.7CVE-2026-117604
• 8.8CVE-2026-116019
• 7.0CVE-2026-114660
• 6.9CVE-2026-114657
• 8.7CVE-2026-112782

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-109325
• https://nvd.nist.gov/vuln/detail/CVE-2026-109325
• https://github.com/getgrav/grav/security/advisories/GHSA-v8fx-pc9p-934x
• https://www.vulncheck.com/advisories/grav-from-2.0.22-before-2.1.7-clockwork-profiler-authentication-bypass-via-proxy