Is CVE-2026-55885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55885 being exploited in the wild.

How severe is CVE-2026-55885?

Medium severity, with a CVSS score of 6.8, published 10 July 2026.

Which products and versions are affected?

Grav Admin Plugin < 1.10.53; Grav < 1.7.53; getgrav/grav (Packagist) < 1.7.53, ECOSYSTEM:introduced=0,fixed=1.7.53.

Is there a fix for CVE-2026-55885?

Yes. getgrav/grav (Packagist): upgrade to 1.7.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55885 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55885?

Check whether you run Grav Admin Plugin, Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55885: Grav sensitive data exposure in Admin backup component

Q: Which products and versions are affected?

Grav Admin Plugin < 1.10.53; Grav < 1.7.53; getgrav/grav (Packagist) < 1.7.53, ECOSYSTEM:introduced=0,fixed=1.7.53.

Q: Is there a fix for CVE-2026-55885?

Yes. getgrav/grav (Packagist): upgrade to 1.7.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55885 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55885?

Check whether you run Grav Admin Plugin, Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55885 · Severity: medium · CVSS 6.8 · Published 2026-07-10

Grav is a file-based content management system. A vulnerability in the backup system allows an administrator with backup permissions to download a full archive of the website's files, which includes sensitive configuration data and encrypted password hashes for all users. If an attacker obtains these files, they can perform offline password cracking to take over other administrator accounts and gain full control over the website and its data.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-55885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55885 being exploited in the wild.
How severe is CVE-2026-55885?: Medium severity, with a CVSS score of 6.8, published 10 July 2026.
Which products and versions are affected?: Grav Admin Plugin < 1.10.53; Grav < 1.7.53; getgrav/grav (Packagist) < 1.7.53, ECOSYSTEM:introduced=0,fixed=1.7.53.
Is there a fix for CVE-2026-55885?: Yes. getgrav/grav (Packagist): upgrade to 1.7.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55885 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55885?: Check whether you run Grav Admin Plugin, Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 1.7.53 or later
```
composer require getgrav/grav:^1.7.53
```

Technical details

A vulnerability in Grav's backup component (Backups::backup()) and the Admin plugin's controller (AdminController::taskBackup()) allows for sensitive data exfiltration. The default backup profile captures the entire GRAV_ROOT, including bcrypt password hashes in 'user/accounts/' and SMTP/system secrets in 'user/config/'. The download endpoint is insufficiently protected, relying only on a session-static 'admin-nonce' in the URL rather than a per-request form-level CSRF token. Furthermore, the download handler reveals the server's absolute filesystem path via a Base64-encoded query parameter. An attacker who obtains the static nonce (e.g., via Referrer leakage or XSS) can trigger a backup and download the archive to perform offline credential cracking. This issue is fixed in Grav version 1.7.53 and Admin plugin version 1.10.53.

Affected products

getgrav Grav < 1.7.53
getgrav Admin Plugin < 1.10.53

Identifiers

CVE-2026-55885
GHSA-2f86-9cp8-6hcf

Timeline

2026-06-16: patched: Version 1.7.53 released
2026-06-17: advisory: GitHub Security Advisory published
2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.