Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-55885Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Medium 6.8

In plain English

A medium-severity security flaw in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	1.7.53	GHSA-2f86-9cp8-6hcf

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	< 1.7.53

Weakness: CWE-312, CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf x_refsource_CONFIRM
https://github.com/getgrav/grav/releases/tag/1.7.53 x_refsource_MISC