CVE-2026-55885 Overview
CVE-2026-55885 affects Grav, a file-based web content management platform. The vulnerability allows an authenticated administrator with backup permissions to download a ZIP archive containing the entire Grav installation root. The archive includes user/accounts/admin.yaml with administrator password hashes and user/config containing site configuration data. The backup download endpoint is protected only by the session-static admin-nonce URL parameter, which does not provide sufficient access control for the sensitive data returned. The issue is classified under [CWE-312: Cleartext Storage of Sensitive Information]. Grav version 1.7.53 addresses the flaw.
Critical Impact
An authenticated backup-privileged administrator can exfiltrate password hashes and full site configuration via the backup download endpoint.
Affected Products
- Grav CMS versions prior to 1.7.53
- Grav installations exposing the administrator backup functionality
- Grav deployments where non-superuser accounts hold backup permissions
Discovery Timeline
- 2026-07-10 - CVE-2026-55885 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-55885
Vulnerability Analysis
Grav ships with an administrator backup feature that produces a ZIP archive of the full installation. The backup download endpoint accepts an admin-nonce URL parameter as its access control mechanism. The generated archive includes the user/accounts/ directory and the user/config directory. These paths hold administrator credential material and site secrets. Any user granted backup permissions can therefore retrieve credentials belonging to other administrators, including the superuser. The admin.yaml file contains password hashes suitable for offline cracking against weak passwords. Site configuration files may contain API keys, SMTP credentials, and third-party service tokens stored in plaintext.
Root Cause
The root cause is a permission scoping error combined with cleartext storage of sensitive data [CWE-312]. The backup routine does not filter sensitive files from the archive based on the requesting user's role. A user with backup capability inherits effective read access to files that normally require superuser privileges. The admin-nonce parameter is session-static and predictable within an authenticated session, offering no additional authorization beyond the initial permission check.
Attack Vector
Exploitation requires an authenticated Grav admin session with backup permission. The attacker navigates to the backup interface, triggers archive creation, and downloads the resulting ZIP via the protected endpoint. The attacker then extracts user/accounts/admin.yaml and attempts offline password cracking against the hash of a higher-privileged account. Successful cracking yields superuser access. Extracted configuration files provide additional lateral movement paths through captured third-party credentials.
No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-2f86-9cp8-6hcf for the vendor's technical description.
Detection Methods for CVE-2026-55885
Indicators of Compromise
- Unexpected requests to the Grav admin backup download endpoint containing an admin-nonce URL parameter
- Creation of large ZIP archives under the Grav backup/ directory outside of scheduled maintenance windows
- Admin session activity from non-superuser accounts that includes backup generation followed by immediate download
- Access to user/accounts/admin.yaml or user/config/ files by low-privilege admin roles
Detection Strategies
- Review web server access logs for GET requests to Grav backup download URLs correlated with the authenticated user's role
- Alert on any backup archive download performed by an account that is not the designated superuser
- Monitor filesystem events on the Grav installation directory for ZIP archive creation events tied to non-scheduled operations
Monitoring Recommendations
- Ingest Grav administrative access logs into a centralized logging platform and build alerts on backup endpoint activity
- Track the population of accounts holding the backup permission and generate alerts when new grants are made
- Baseline normal backup frequency and volume so anomalous download patterns surface quickly
How to Mitigate CVE-2026-55885
Immediate Actions Required
- Upgrade Grav to version 1.7.53 or later as published in the GitHub Release 1.7.53 notes
- Audit all administrator accounts and revoke the backup permission from any user who does not strictly require it
- Rotate all administrator passwords and any secrets stored in user/config that may have been exposed to backup-privileged users
- Invalidate active admin sessions to force re-authentication after the upgrade
Patch Information
The vendor released Grav 1.7.53 to remediate CVE-2026-55885. Refer to the GitHub Security Advisory GHSA-2f86-9cp8-6hcf for advisory details and to the GitHub Release 1.7.53 page for upgrade artifacts.
Workarounds
- Restrict the backup permission to a single trusted superuser account until the patch is applied
- Place the Grav admin interface behind a network access control layer such as VPN or IP allowlisting
- Remove or comment out non-essential secrets from user/config files and load them from environment variables instead
- Enforce strong, high-entropy passwords for all administrator accounts to raise the cost of offline hash cracking
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
