Executive brief
The database plugin for Grav CMS contains a vulnerability that allows administrators to manipulate database connection settings. By injecting malicious characters into configuration fields, an attacker could redirect database traffic to unauthorized servers, access sensitive files on the system, or disable security encryption. This could lead to the exposure of customer data or unauthorized access to internal database systems.
Technical details
The Database::__call() method in the Grav database plugin (prior to 1.2.0) constructs PDO Data Source Name (DSN) strings by directly concatenating user-provided YAML configuration values. Fields such as host, dbname, charset, and directory are not sanitized for special characters like semicolons, null bytes, or path traversal sequences (../). An attacker with administrative access to the plugin configuration can perform DSN attribute injection to redirect connections, use path traversal to access arbitrary SQLite databases on the filesystem, or inject attributes like 'TrustServerCertificate=true' to bypass TLS verification in SQLSRV environments. The issue is resolved in version 1.2.0 by hardening DSN construction and implementing server-side validation.
Affected products
- getgrav grav-plugin-database < 1.2.0
Timeline
- 2026-06-18: patched: Fixes committed and version 1.2.0 released.
- 2026-07-10: disclosed: CVE-2026-58493 published.