# CVE-2026-55885: Grav sensitive data exposure in Admin backup component

Source: https://junglewise.ai/threats/cve-2026-55885-grav-sensitive-data-exposure-in-admin-backup-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55885 · Severity: medium · CVSS 6.8 · Published 2026-07-10

Grav is a file-based content management system. A vulnerability in the backup system allows an administrator with backup permissions to download a full archive of the website's files, which includes sensitive configuration data and encrypted password hashes for all users. If an attacker obtains these files, they can perform offline password cracking to take over other administrator accounts and gain full control over the website and its data.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55885 being exploited in the wild.

**How severe is CVE-2026-55885?** Medium severity, with a CVSS score of 6.8, published 10 July 2026.

**Which products and versions are affected?** Grav Admin Plugin < 1.10.53; Grav < 1.7.53; getgrav/grav (Packagist) < 1.7.53, ECOSYSTEM:introduced=0,fixed=1.7.53.

**Is there a fix for CVE-2026-55885?** Yes. getgrav/grav (Packagist): upgrade to 1.7.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55885 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55885?** Check whether you run Grav Admin Plugin, Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 1.7.53 or later

  ```sh
  composer require getgrav/grav:^1.7.53
  ```


## Technical details

A vulnerability in Grav's backup component (Backups::backup()) and the Admin plugin's controller (AdminController::taskBackup()) allows for sensitive data exfiltration. The default backup profile captures the entire GRAV_ROOT, including bcrypt password hashes in 'user/accounts/' and SMTP/system secrets in 'user/config/'. The download endpoint is insufficiently protected, relying only on a session-static 'admin-nonce' in the URL rather than a per-request form-level CSRF token. Furthermore, the download handler reveals the server's absolute filesystem path via a Base64-encoded query parameter. An attacker who obtains the static nonce (e.g., via Referrer leakage or XSS) can trigger a backup and download the archive to perform offline credential cracking. This issue is fixed in Grav version 1.7.53 and Admin plugin version 1.10.53.

## Affected products

- getgrav Grav < 1.7.53
- getgrav Admin Plugin < 1.10.53

## Identifiers

- CVE-2026-55885
- GHSA-2f86-9cp8-6hcf

## Timeline

- 2026-06-16: patched: Version 1.7.53 released
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD

## References

- [https://github.com/getgrav/grav/releases/tag/1.7.53](https://github.com/getgrav/grav/releases/tag/1.7.53)
- [https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf](https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)