Which versions of Grav Database Plugin are affected by CVE-2026-58492?

Grav CMS Database plugin versions prior to 1.2.0 contain an unpatched critical SQL injection vulnerability in the PDO::tableExists method that could permit attackers to execute arbitrary database…. A patch is available.

How to fix or mitigate CVE-2026-58492?

Within 24 hours: Inventory all systems running grav-plugin-database, document versions, and identify plugins or custom code consuming the PDO::tableExists method. Within 7 days: Implement strict input validation and whitelisting for table-name parameters across all database method calls; conduct code audit of database plugin integrations and apply principle of least privilege to database service accounts. Within 30 days: Monitor Grav security advisories for release of version 1.2.0 or later; plan and execute upgrade once patch is confirmed; evaluate alternative database abstraction layers if patch release extends beyond 90 days.

Grav Database Plugin CVE-2026-58492

Q: What is the CVSS score of CVE-2026-58492?

CVE-2026-58492 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42947 CRITICAL

SQL Injection (CWE-89)

2026-07-10 GitHub_M

SQLi Grav

9.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

AC:H because exploitation depends on a consuming code path forwarding tainted table names; PR:N/UI:N as the flaw itself needs no auth, with high C/I and limited availability impact from arbitrary SQL.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 18:01 EUVD

Analysis Generated

Jul 10, 2026 - 16:54 vuln.today

DescriptionCVE.org

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.

AnalysisAI

SQL injection in the Grav CMS Database plugin (grav-plugin-database) prior to 1.2.0 lets attacker-controlled table names reach a raw SQL query. The PDO::tableExists method interpolates its table argument directly into a query with no sanitization, escaping, quoting, or whitelisting, so any consuming plugin or developer code that forwards untrusted input into that method can execute arbitrary SQL against the configured database. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach plugin endpoint forwarding table name

Delivery

Submit crafted table-name with appended SQL

Exploit

Value interpolated into tableExists query

Execution

Arbitrary SQL executes on database

Impact

Read or modify database contents