Medium severity · published Oct 12, 2026
CVE-2026-109316
Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-data-manager · getgrav
1.4.0 before 1.4.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109316
vendor-advisory
https://github.com/getgrav/grav/security/advisories/GHSA-mh96-26mx-hf3g
third-party-advisory
https://www.vulncheck.com/advisories/grav-data-manager-1.4.0-through-1.4.5-unauthenticated-file-deletion-via-admin