CVE-2026-58493 grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction
Administrators can inject DSN attributes or path traversal values into database connection strings via unsanitized configuration fields in the Grav database plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58493?
CVE-2026-58493 is a medium-severity vulnerability in getgrav grav, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.
Weakness: CWE-74
Which versions are affected by CVE-2026-58493?
How do I fix CVE-2026-58493?
No fix has been published for CVE-2026-58493 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-58493 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58493 exists.
Sources
Also known as GHSA-jm58-p4pv-qcwc.