Grav CMS EUVD-2026-97627

Requires (1) the Grav Clockwork profiler to be active, and (2) the application to sit behind a same-host HTTP proxy so that attacker requests present a loopback REMOTE_ADDR (e.g. 127.0.0.1), which the profiler wrongly treats as an authorized local client. Affected builds are Grav 2.0.22 through 2.1.6. Limiting factors: the profiler is typically a development/debug feature and may be disabled in production, and the attacker must be able to deliver requests through the local proxy path - direct internet-facing requests without the loopback-presenting proxy would not satisfy the trust condition. No user interaction or authentication is needed once those conditions hold.

This is a genuine but conditional information-disclosure flaw, not a blanket high-severity emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and implies trivial unauthenticated network exploitation, but the description narrows this sharply: exploitation requires requests to arrive 'behind a same-host HTTP proxy' so that REMOTE_ADDR appears as loopback, and the Clockwork profiler must be active. The CVSS vector and the description are therefore in partial tension - the AC:L/PR:N metrics do not capture the required same-host proxy deployment state, so real-world reachability is narrower than 8.7 suggests. Impact is confidentiality-only (VC:H, VI:N, VA:N), consistent with CWE-200: exposure of configuration, secrets, request metadata, and queries, which can be chained toward further compromise even though this flaw alone grants no code execution or write access. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a credible priority for any Grav deployment that fronts the app with a local reverse proxy and leaves the profiler enabled, but lower urgency for hardened production instances with the profiler disabled.

An attacker who can route HTTP requests through a same-host reverse proxy (for example a shared-hosting or containerized deployment where nginx forwards to PHP and REMOTE_ADDR becomes 127.0.0.1) sends requests to the Clockwork profiler endpoints. Because the profiler trusts the loopback source address as implicitly authorized, it returns profiler records containing system and plugin configuration, secrets, request metadata, and database queries without any authentication. No public exploit code was identified at time of analysis, so this would require manual request crafting against the Clockwork API.