PT-2026-57224 · Getgrav · Grav

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-58493

Mitre

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database:: call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-58493

Affected Products

Grav

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-58493 · Security Note
• https://github.com/getgrav/grav/security/advisories/GHSA-jm58-p4pv-qcwc · Note
• https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df · Note
• https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0 · Note