CVE-2026-58493: Grav Database Plugin Path Traversal Flaw

CVE-2026-58493 Overview

CVE-2026-58493 affects grav-plugin-database, the database plugin for Grav CMS. Versions prior to 1.2.0 build PDO Data Source Name (DSN) strings by directly concatenating user-configurable YAML values. Fields such as host, dbname, charset, server, database, directory, and filename are concatenated without sanitization or validation. An administrator with plugin configuration access can inject DSN attributes or path traversal values. The issue is classified as improper neutralization of special elements in output used by a downstream component [CWE-74]. Version 1.2.0 resolves the flaw.

Critical Impact
An authenticated administrator can manipulate PDO DSN attributes or traverse the file system through unsanitized YAML configuration values, resulting in limited confidentiality and integrity impact on the Grav CMS host.

Affected Products

Grav CMS grav-plugin-database versions prior to 1.2.0
Grav CMS deployments exposing the database plugin configuration UI to administrators
Any third-party integrations relying on the vulnerable Database::__call DSN construction

Discovery Timeline

2026-07-10 - CVE-2026-58493 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-58493

Vulnerability Analysis

The flaw resides in the Database::__call method of the Grav database plugin. The method constructs PDO DSN strings by concatenating YAML configuration values directly into the connection string. No input validation, escaping, or allow-list check runs against fields such as host, dbname, charset, server, database, directory, or filename. An administrator with configuration access can append arbitrary DSN key-value pairs. The same channel accepts path traversal sequences that redirect SQLite-style directory and filename parameters to unintended locations on disk. Exploitation requires high privileges over the plugin configuration but does not require user interaction.

Root Cause

The root cause is the absence of neutralization for special characters flowing from a YAML configuration source into a downstream PDO connection component [CWE-74]. Concatenation replaces safe key parameterization. Path components accept ../ sequences because the plugin does not resolve or canonicalize the supplied file paths.

Attack Vector

An attacker who already holds administrator credentials for the Grav backend modifies the database plugin YAML. They insert additional DSN attributes such as alternate hosts, socket paths, or unexpected drivers. For file-based drivers, the attacker supplies traversal strings in directory or filename to point the database engine at attacker-controlled or sensitive locations. The exploit path is network-reachable through the Grav administration interface.

php

// Pre-patch: classes/PDO.php (vulnerable pattern)
<?php
namespace Grav\Plugin\Database;

class PDO extends \PDO
{
    public function __call($func, $args)
    {
        if (
            !\in_array($func, [
                'select',
                'selectall',
                'update',
                'delete',
                'insert',
            ])
        ) {
            throw new \RuntimeException($func . ' is not a valid statement');
        }

        if (\count($args) === 2) {
            $stmt = parent::prepare($args[0]);
            $stmt->execute($args[1]);
        } elseif ($args) {
            $stmt = parent::query($args[0]);
        }
        if ((int) $stmt->errorCode()) {
            throw new \RuntimeException($stmt->errorInfo()[2]);
        }
    }
}
// Source: https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df

Detection Methods for CVE-2026-58493

Indicators of Compromise

Unexpected modifications to user/plugins/database.yaml or equivalent Grav configuration files.
PDO DSN strings in logs containing traversal sequences such as ../ in directory or filename values.
Grav administrative sessions writing plugin configuration outside of scheduled change windows.

Detection Strategies

Compare deployed grav-plugin-database version against 1.2.0 using file inventory or software composition analysis.
Alert on YAML configuration writes containing unexpected DSN attributes such as additional host=, unix_socket=, or driver switches.
Correlate administrator logins with subsequent plugin configuration changes and outbound database connections to non-baseline hosts.

Monitoring Recommendations

Enable PHP and PDO error logging to capture connection attempts to unusual DSN targets.
Monitor file access on the Grav user/ directory tree for path traversal read attempts originating from PHP processes.
Track authenticated administrator activity through web server access logs and Grav audit trails.

How to Mitigate CVE-2026-58493

Immediate Actions Required

Upgrade grav-plugin-database to version 1.2.0 or later.
Review current YAML configuration for unexpected DSN attributes or traversal characters and revert to known-good values.
Rotate administrator credentials and audit accounts that hold plugin configuration privileges.

Patch Information

The fix is available in the GitHub Release Tag 1.2.0 and delivered by GitHub Commit f6d0587. The upstream advisory is documented in GitHub Security Advisory GHSA-jm58-p4pv-qcwc. The patch refactors __call handling into a shared StatementHelpers trait and enforces validation before DSN construction.

Workarounds

Restrict administrative access to the Grav backend using network controls and multifactor authentication until the upgrade is complete.
Enforce file integrity monitoring on the plugin configuration directory to detect unauthorized YAML edits.
Apply the principle of least privilege by removing plugin configuration rights from accounts that do not require them.

bash

# Upgrade grav-plugin-database via Grav CLI
cd /path/to/grav
bin/gpm update database
bin/gpm info database | grep -i version
# Confirm version is 1.2.0 or later