PT-2026-50744 · Packagist+2 · Getgrav/Grav+1

CVE-2026-55885

·

Published

2026-06-18

·

Updated

2026-07-10

CVSS v3.1

6.8

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.53
Description An authenticated administrator with backup permissions can download a ZIP archive containing the full installation root. This archive includes sensitive files such as user/accounts/admin.yaml, which contains the administrator's bcrypt password hash and email, and the user/config/ directory containing site configurations. The issue occurs because the backup download endpoint is protected only by a session-static admin-nonce URL parameter and lacks a form-level CSRF token. Additionally, the download process reveals the server's full filesystem path via a Base64-encoded query parameter. An attacker who obtains the admin-nonce value through browser history, Referrer leakage, or XSS can exfiltrate these hashes for offline cracking to achieve account takeover.
Technical details include:
  • API Endpoints: /admin/task:backup/download and /admin/tools/backups.json/task:backup
  • Vulnerable Parameters: admin-nonce
  • Function Names: Backups::backup() and AdminController::taskBackup()
Recommendations Update Grav to version 1.7.53 or later.

Exploit

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-522CWE-312

Related Identifiers

CVE-2026-55885
GHSA-2F86-9CP8-6HCF

Affected Products

Getgrav/Grav
Grav