Grav Database Plugin CVE-2026-58493

Exploitation requires administrator-level access to the Grav CMS plugin configuration interface - specifically, the ability to write to the database plugin's YAML configuration fields (host, dbname, charset, server, database, directory, filename). This is a PR:H (high-privilege) condition. Exploitation is further limited to environments where the grav-plugin-database plugin is installed and active; sites running Grav CMS without this optional plugin are not affected. The attack is not exploitable by unauthenticated users or lower-privilege Grav roles. What limits exploitation in practice: (1) admin credentials must already be compromised or the attack must be an insider threat; (2) the DSN injection impact is constrained to database connection parameters, not arbitrary OS command execution; (3) path traversal impact depends on the PDO driver in use (SQLite-based drivers are more susceptible than MySQL/PostgreSQL which do not use filesystem paths in DSN fields).

The CVSS 4.0 base score of 5.1 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N accurately reflects the constrained real-world risk: exploitation requires PR:H (high-privilege, administrator-level) access to the Grav plugin configuration interface, substantially limiting the attack surface to insider threats or compromised admin accounts. The network attack vector (AV:N) acknowledges that the Grav admin panel is typically web-accessible, but the PR:H requirement means this is not a remotely unauthenticated issue. The confidentiality and integrity impacts are both rated Low, consistent with partial database misdirection or limited path traversal rather than full system compromise. No KEV listing and no public POC have been identified, and the EPSS signal is not provided - this reduces urgency significantly. The vulnerability is best characterized as a privilege-boundary control flaw affecting trust assumptions within the admin tier, not a lateral escalation or remote exploitation path. For organizations where admin credentials are tightly controlled, this poses minimal incremental risk beyond already-trusted administrator access.

An attacker who has obtained Grav CMS administrator credentials - through credential stuffing, phishing, or a compromised account - navigates to the Database plugin configuration panel and modifies the host or directory YAML field to include injected DSN attributes such as localhost;unix_socket=/var/run/attacker/malicious.sock or a path traversal value like ../../sensitive_dir. When the plugin subsequently invokes Database::__call, the malformed DSN is passed to PDO, redirecting the database connection to an unintended socket or filesystem location, potentially exposing data from an alternate database or traversing to restricted file paths. No public POC has been identified at time of analysis.