CVE-2026-58493

UNKNOWN 0.0

grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction

CVSS Score

0.0

EPSS Score

0.3%

EPSS Percentile

21th

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.

CWE	CWE-74
Vendor	getgrav
Product	grav
Published	Jul 10, 2026
Last Updated	Jul 13, 2026

Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new unknown vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

getgrav / grav

< 1.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-jm58-p4pv-qcwc github.com: https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df github.com: https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0