Grav Comments Plugin EUVD-2026-87766

Exploitable only when the site runs the classic Grav Admin plugin AND the Comments plugin is enabled (the default combination). The attacker sends an unauthenticated GET to /admin/comments/page:<n> (e.g. page:0.001); no credentials, tokens, or user interaction are required. What LIMITS exploitation: sites running the Grav 2.0 Admin Next stack (admin2 + api) are NOT affected via this path, and sites on 1.2.11 or later require an authenticated user holding admin.comments or admin.super. Impact is confined to disclosure of comment records from the last 7 days plus commenter emails and the data-file absolute path - no write or execution capability.

This is a genuine but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects that exploitation is remote, unauthenticated, requires no user interaction, and is trivially automatable - a single GET to a predictable URL. That combination makes real-world exploitation easy and mass-scannable. However, impact is strictly confidentiality (VC:H, with VI:N/VA:N/SC:N/SI:N/SA:N), so there is no code execution, data modification, or availability loss. The vendor's VC:H rating (driving the 8.7 aggregate) is arguably generous: the disclosed data is limited to comments from the last 7 days plus commenter email addresses and an absolute server filesystem path - meaningful PII leakage and useful recon, but not a full confidentiality compromise of the system, so I assess confidentiality as Low rather than High. No EPSS score, KEV listing, or public POC is present in the input, so there is no evidence of active exploitation despite the high score. The dominant signal here is ease/automatability of the info leak, not catastrophic impact; treat as a real-but-moderate priority, prioritized upward because it is unauthenticated and affects the default configuration.

An unauthenticated attacker scans Grav sites running the classic Admin plugin with the Comments plugin enabled and requests /admin/comments/page:0.001. The vulnerable handler branches only on isAdmin() (which merely means the admin route is registered, not that the visitor is logged in) and echoes comment JSON with exit() before the login screen renders, returning every comment from the last 7 days along with commenter email addresses and the absolute filesystem path of the data file. No public exploit code is identified at time of analysis, but the request is trivial to craft and automate.