PT-2026-57224 · Grav · Grav-Plugin-Database
CVE-2026-58493
·
Published
2026-07-10
·
Updated
2026-07-10
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
grav-plugin-database versions prior to 1.2.0
Description
The
Database:: call function builds PDO DSN (Data Source Name) strings by directly concatenating user-configurable YAML values from fields including host, dbname, charset, server, database, directory, and filename without proper sanitization or validation. This allows an administrator with plugin configuration access to inject DSN attributes or perform path traversal.Recommendations
Update to version 1.2.0.
Exploit
Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grav-Plugin-Database