Executive brief
Grav is a file-based content management system. A vulnerability in the backup system allows an administrator with backup permissions to download a full archive of the website's files, which includes sensitive configuration data and encrypted password hashes for all users. If an attacker obtains these files, they can perform offline password cracking to take over other administrator accounts and gain full control over the website and its data.
Technical details
A vulnerability in Grav's backup component (Backups::backup()) and the Admin plugin's controller (AdminController::taskBackup()) allows for sensitive data exfiltration. The default backup profile captures the entire GRAV_ROOT, including bcrypt password hashes in 'user/accounts/' and SMTP/system secrets in 'user/config/'. The download endpoint is insufficiently protected, relying only on a session-static 'admin-nonce' in the URL rather than a per-request form-level CSRF token. Furthermore, the download handler reveals the server's absolute filesystem path via a Base64-encoded query parameter. An attacker who obtains the static nonce (e.g., via Referrer leakage or XSS) can trigger a backup and download the archive to perform offline credential cracking. This issue is fixed in Grav version 1.7.53 and Admin plugin version 1.10.53.
Affected products
- getgrav Grav < 1.7.53
- getgrav Admin Plugin < 1.10.53
Timeline
- 2026-06-16: patched: Version 1.7.53 released
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD