EUVD-2026-42947Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin endpoint forwarding table name
-
DeliverySubmit crafted table-name with appended SQL
-
ExploitValue interpolated into tableExists query
-
ExecutionArbitrary SQL executes on database
-
ImpactRead or modify database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a consuming Grav plugin or developer code path that passes attacker-controlled input as the table-name argument to the Database plugin's PDO::tableExists method - the vulnerable method does not receive untrusted input on its own, which is exactly the AT:P attack-requirement in the CVSS 4.0 vector. When such a data flow exists, no authentication (PR:N) and no user interaction (UI:N) are needed and the attack is network-reachable (AV:N). The primary limiting factor is that stock Grav plus the database plugin, without a downstream integration forwarding external input into tableExists(), is not directly exploitable; the affected version boundary is any grav-plugin-database release prior to 1.2.0. |
| Impact | Signals are mixed and should temper the raw 9.2 CVSS 4.0 score. The vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L) shows network reach with no authentication and high confidentiality/integrity impact, but the AT:P attack-requirement is the pivotal caveat: exploitation is only possible when a consuming plugin or developer's code passes attacker-controlled input into tableExists(), which is not the default data flow of the plugin itself. This makes the vulnerability library-level and conditional rather than a turnkey remote SQLi against every Grav site. There is no CISA KEV entry (not confirmed actively exploited) and no public proof-of-concept identified, so real-world weaponization currently depends on the presence of a vulnerable downstream integration. EPSS and SSVC data were not provided in the input and cannot be asserted. Net assessment: genuinely serious for sites whose custom or third-party plugins route user input to tableExists(), but lower practical risk for stock deployments - prioritize patching where the database plugin is used with user-influenced table names. |
| Exploit ScenarioDerived | A site runs a Grav plugin that accepts a table or dataset name from an HTTP request parameter and passes it to the database plugin's tableExists() before querying. An unauthenticated attacker submits a crafted value such as a table name containing appended SQL (e.g. a stacked or UNION statement), which is interpolated into the raw query and executed, letting the attacker read or modify database contents. No public PoC is currently identified, and success depends on the presence of such a vulnerable consuming code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
SQL injection in the Grav CMS Database plugin (grav-plugin-database) prior to 1.2.0 lets attacker-controlled table names reach a raw SQL query. The PDO::tableExists method interpolates its table argument directly into a query with no sanitization, escaping, quoting, or whitelisting, so any consuming plugin or developer code that forwards untrusted input into that method can execute arbitrary SQL against the configured database. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2, with an attack-requirement (AT:P) reflecting the dependency on downstream code passing tainted table names.
RemediationAI
Vendor-released patch: upgrade grav-plugin-database to 1.2.0 or later, which fixes the identifier injection in PDO::tableExists (release https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0, commit f6d058785c9e23df7efc5ea7556f8746fef286df, advisory GHSA-8jxg-4pw9-xcwf). If you cannot upgrade immediately, audit your own and third-party plugin code for any call path that passes external or user-influenced values into tableExists(), and constrain those callers to validate table names against a fixed allowlist of known tables before the call - the trade-off is manual code review and the risk of missing an indirect data flow. As a further compensating control, restrict the database account used by Grav to least privilege (limited to intended tables, minimal DDL rights) so injected SQL cannot drop or alter unintended objects, accepting that this may break plugins expecting broader schema access. These workarounds do not fully close the flaw; the upgrade to 1.2.0 is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a flat-file PHP CMS, and grav-plugin-database is its optional plugin providing a PDO-backed relational database layer for other plugins and site code. The flaw sits in the PDO wrapper's tableExists() helper, which builds a SQL statement by concatenating the caller-supplied table name into the query string rather than binding it as a parameter or validating it against schema metadata - note that SQL identifiers such as table names cannot be bound via placeholders, so safe implementations must whitelist or quote them. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifier-injection: because the tainted value lands in the query body, an attacker who controls the table-name string can break out of the intended identifier context and append arbitrary SQL. The single affected CPE is cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*, covering Grav installations that load the vulnerable database plugin.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
AC:H because exploitation depends on a consuming code path forwarding tainted table names; PR:N/UI:N as the flaw itself needs no auth, with high C/I and limited availability impact from arbitrary SQL.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.
Executive ViewAI
Grav CMS Database plugin versions prior to 1.2.0 contain an unpatched critical SQL injection vulnerability in the PDO::tableExists method that could permit attackers to execute arbitrary database queries if downstream code passes untrusted input. Organizations deploying Grav CMS face immediate risk of unauthorized database access and potential data compromise; the vulnerability persists without a vendor patch and requires urgent remediation through input controls and code review.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce strict input validation with whitelist-only table names; reject all values not in predefined safe list. (2) Restrict database service account permissions to minimum required operations. (3) Enable and monitor database query logs for suspicious SQL patterns; configure alerting on injection signatures. (4) Segment Grav CMS instances to trusted networks only. (5) Audit all installed plugins and custom code for unsafe PDO::tableExists consumption; refactor to eliminate untrusted input forwarding. (6) Deploy database activity monitoring or WAF rules to detect and block SQL injection payloads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB