CVE-2026-58492 grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation
Attackers can execute arbitrary SQL commands via unsanitized table names in the Grav CMS database plugin, potentially compromising database integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58492?
CVE-2026-58492 is a critical SQL injection vulnerability in getgrav grav, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-58492?
How do I fix CVE-2026-58492?
No fix has been published for CVE-2026-58492 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-58492 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58492 exists.
Sources
Also known as GHSA-8jxg-4pw9-xcwf.