CVE-2026-109316

Name of the Vulnerable Software and Affected Versions Grav Data Manager plugin versions 1.4.0 through 1.4.5

Description Missing authorization allows unauthenticated attackers to delete stored data files through the classic Admin integration. By sending a request containing the delete parameter along with a known data type and filename, attackers can remove files located under user/data/, such as form submissions. This is possible because the system fails to perform CSRF (Cross-Site Request Forgery) nonce checks, which are unique tokens used to prevent unauthorized command execution from a user's browser.

Recommendations Update Grav Data Manager plugin to a version later than 1.4.5.