Grav Plugin Data Manager
Monthly
Unauthenticated attackers can delete arbitrary files stored under the user/data/ directory in installations of the Grav Data Manager plugin versions 1.4.0 through 1.4.5 when the classic Admin integration is active. The vulnerability arises from missing authorization checks and absent CSRF nonce validation, enabling requests with a delete parameter and a known data type/filename to remove files such as form submissions. This moderate-severity flaw (CVSS 4.0 base score 6.9; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) has no public exploit identified at time of analysis, and exploitation is limited to integrity and availability impacts on existing data files.
Unauthenticated attackers can delete arbitrary files stored under the user/data/ directory in installations of the Grav Data Manager plugin versions 1.4.0 through 1.4.5 when the classic Admin integration is active. The vulnerability arises from missing authorization checks and absent CSRF nonce validation, enabling requests with a delete parameter and a known data type/filename to remove files such as form submissions. This moderate-severity flaw (CVSS 4.0 base score 6.9; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) has no public exploit identified at time of analysis, and exploitation is limited to integrity and availability impacts on existing data files.