Medium severity · published Jul 10, 2026
CVE-2026-58493
grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
< 1.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58493
github.com
https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df
github.com
https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-jm58-p4pv-qcwc
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)