Which versions of Grav Database Plugin are affected by CVE-2026-58492?

Grav CMS Database plugin versions prior to 1.2.0 contain an unpatched critical SQL injection vulnerability in the PDO::tableExists method that could permit attackers to execute arbitrary database…. A patch is available.

How to fix or mitigate CVE-2026-58492?

Within 24 hours: Inventory all systems running grav-plugin-database, document versions, and identify plugins or custom code consuming the PDO::tableExists method. Within 7 days: Implement strict input validation and whitelisting for table-name parameters across all database method calls; conduct code audit of database plugin integrations and apply principle of least privilege to database service accounts. Within 30 days: Monitor Grav security advisories for release of version 1.2.0 or later; plan and execute upgrade once patch is confirmed; evaluate alternative database abstraction layers if patch release extends beyond 90 days.

Grav Database Plugin CVE-2026-58492

Q: What is the CVSS score of CVE-2026-58492?

CVE-2026-58492 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42947 CRITICAL

SQL Injection (CWE-89)

2026-07-10 GitHub_M

SQLi Grav Getgrav

9.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

AC:H because exploitation depends on a consuming code path forwarding tainted table names; PR:N/UI:N as the flaw itself needs no auth, with high C/I and limited availability impact from arbitrary SQL.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 18:01 EUVD

Analysis Generated

Jul 10, 2026 - 16:54 vuln.today

DescriptionCVE.org

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.

AnalysisAI

SQL injection in the Grav CMS Database plugin (grav-plugin-database) prior to 1.2.0 lets attacker-controlled table names reach a raw SQL query. The PDO::tableExists method interpolates its table argument directly into a query with no sanitization, escaping, quoting, or whitelisting, so any consuming plugin or developer code that forwards untrusted input into that method can execute arbitrary SQL against the configured database. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2, with an attack-requirement (AT:P) reflecting the dependency on downstream code passing tainted table names.

Technical ContextAI

Grav is a flat-file PHP CMS, and grav-plugin-database is its optional plugin providing a PDO-backed relational database layer for other plugins and site code. The flaw sits in the PDO wrapper's tableExists() helper, which builds a SQL statement by concatenating the caller-supplied table name into the query string rather than binding it as a parameter or validating it against schema metadata - note that SQL identifiers such as table names cannot be bound via placeholders, so safe implementations must whitelist or quote them. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifier-injection: because the tainted value lands in the query body, an attacker who controls the table-name string can break out of the intended identifier context and append arbitrary SQL. The single affected CPE is cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*, covering Grav installations that load the vulnerable database plugin.

RemediationAI

Vendor-released patch: upgrade grav-plugin-database to 1.2.0 or later, which fixes the identifier injection in PDO::tableExists (release https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0, commit f6d058785c9e23df7efc5ea7556f8746fef286df, advisory GHSA-8jxg-4pw9-xcwf). If you cannot upgrade immediately, audit your own and third-party plugin code for any call path that passes external or user-influenced values into tableExists(), and constrain those callers to validate table names against a fixed allowlist of known tables before the call - the trade-off is manual code review and the risk of missing an indirect data flow. As a further compensating control, restrict the database account used by Grav to least privilege (limited to intended tables, minimal DDL rights) so injected SQL cannot drop or alter unintended objects, accepting that this may break plugins expecting broader schema access. These workarounds do not fully close the flaw; the upgrade to 1.2.0 is the definitive fix.