Critical severity · published Jul 10, 2026
CVE-2026-58492
grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation
9.2
CVSS
0.5%
EPSS
No
On KEV
Description
grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
< 1.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58492
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58492
github.com
https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df
github.com
https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-8jxg-4pw9-xcwf
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)