Is CVE-2026-109316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109316 being exploited in the wild.

How severe is CVE-2026-109316?

Medium severity, with a CVSS score of 6.5, published 12 October 2026.

Which products and versions are affected?

Grav Data Manager 1.4.0 through 1.4.5.

Is there a fix for CVE-2026-109316?

Yes: fixed in Data Manager 1.4.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109316 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109316?

Check whether you run Grav Data Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109316: Grav Data Manager missing authorization in file deletion

CVE-2026-109316 · Severity: medium · CVSS 6.5 · Published 2026-10-12

Grav's Data Manager plugin is used to store and manage form submission data and other user information. A flaw in versions 1.4.0 through 1.4.5 allows unauthenticated attackers to delete stored data files, including form submissions, by sending a specially crafted request. This can result in loss of critical business data with no authentication required.

Vendors: Grav.

Quick answers

Is CVE-2026-109316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109316 being exploited in the wild.
How severe is CVE-2026-109316?: Medium severity, with a CVSS score of 6.5, published 12 October 2026.
Which products and versions are affected?: Grav Data Manager 1.4.0 through 1.4.5.
Is there a fix for CVE-2026-109316?: Yes: fixed in Data Manager 1.4.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109316 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109316?: Check whether you run Grav Data Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Data Manager 1.4.6

Technical details

The Data Manager plugin's onPagesInitialized handler processes file deletion requests on admin routes without verifying the user's authentication status, authorization level, or a valid CSRF nonce. An attacker who knows a data type and filename can construct a DELETE request to remove files from the user/data/ directory. The vulnerability affects the classic Admin integration path and crosses the anonymous-to-privileged trust boundary.

Affected products

Grav Data Manager 1.4.0 through 1.4.5

Timeline

2026-09-23: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.