Is there a patch available for EUVD-2026-42948?

Yes, a patch is available for EUVD-2026-42948. Update the affected software to the latest version immediately.

Grav Database Plugin EUVD-2026-42948

Q: What is the CVSS score of EUVD-2026-42948?

EUVD-2026-42948 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-58493 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-10 GitHub_M

Path Traversal Grav Getgrav

5.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.8 LOW

Admin-only web panel access sets PR:H and AV:N; DSN injection yields partial data and connection integrity impact only.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 18:01 EUVD

Analysis Generated

Jul 10, 2026 - 17:12 vuln.today

DescriptionCVE.org

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.

AnalysisAI

DSN string injection in grav-plugin-database prior to version 1.2.0 allows an administrator with Grav CMS plugin configuration access to manipulate PDO database connection strings by injecting unsanitized YAML field values. The vulnerable Database::__call method concatenates fields such as host, dbname, charset, server, database, directory, and filename directly into DSN strings without validation, enabling DSN attribute injection or path traversal to redirect database connections to unintended targets. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 1.2.0.

Technical ContextAI

The vulnerability resides in the Database::__call method of grav-plugin-database, a plugin extending Grav CMS (CPE: cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*). PHP's PDO layer constructs database connections via DSN strings such as mysql:host=...;dbname=...;charset=..., where each semicolon-delimited key-value pair can override or extend connection parameters. Because the plugin reads connection parameters directly from administrator-controlled YAML configuration fields without sanitization, CWE-74 (Injection) is the root cause - specifically, an attacker controlling these YAML values can inject additional DSN segments (e.g., appending ;unix_socket=/tmp/attacker.sock) or supply path traversal sequences in filesystem-based DSN fields like directory and filename used by SQLite drivers. The result is that the PDO constructor receives an attacker-influenced DSN rather than the intended one.

RemediationAI

Upgrade grav-plugin-database to version 1.2.0, which addresses the issue per the upstream commit at https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df and the release tag at https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0. If upgrading immediately is not feasible, restrict access to the Grav admin panel to trusted networks or authenticated VPN sessions to prevent unauthorized administrators from reaching the plugin configuration interface - note this does not eliminate the risk from legitimate but compromised admin accounts. As an additional control, audit existing YAML configuration values in the database plugin settings for unexpected semicolons, path traversal sequences (e.g., ../), or unknown DSN attributes, and normalize them to known-good values. There are no additional vendor-published workarounds beyond patching.