Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-58493grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction

Medium 5.1

In plain English

A medium-severity injection in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	< 1.2.0

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/getgrav/grav/security/advisories/GHSA-jm58-p4pv-qcwc x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df x_refsource_MISC
https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0 x_refsource_MISC