CVE-2026-109316

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated remote attackers can delete arbitrary files under user/data/, including form submissions. They only need network access to the Grav classic Admin integration with the target data type and filename.

Root cause

The Data Manager plugin omits authorization checks and CSRF token validation when processing file deletion parameters via the classic Admin integration.

Affected systems

Grav Data Manager plugin 1.4.0 through 1.4.5

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

Upgrade the Data Manager plugin to a version beyond 1.4.5 once available, or disable/remove the Data Manager plugin until patched.

shell

$ bin/gpm install data-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109316