CVE-2026-109316 in Grav Data Manager Plugin
Summary
by MITRE • 10/12/2026
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Grav Data Manager plugin versions 1.4.0 through 1.4.5 suffer from a critical missing authorization vulnerability that permits unauthenticated actors to perform destructive actions against the underlying file system of a targeted web application. This flaw is rooted in the improper implementation of access controls within the classic Admin integration, which fails to verify whether the requesting entity possesses valid administrative privileges or session authentication before executing sensitive operations. By exploiting this deficiency, an attacker can bypass standard security mechanisms and directly interact with internal endpoints designed for data management tasks that should be strictly restricted to authenticated administrators.
The technical mechanism of exploitation involves sending a crafted HTTP request containing specific parameters such as delete flags along with known data types and filenames associated with the Grav platform's storage structure. The vulnerability allows these requests to succeed without requiring a valid CSRF nonce, which is typically used to prevent cross-site request forgery attacks by ensuring that state-changing actions originate from legitimate user interactions within an authenticated session. Consequently, attackers can manipulate the application into deleting arbitrary files located under the user/data directory, effectively stripping the system of its persistent data stores including form submissions and other critical content managed by the plugin.
The operational impact of this vulnerability is severe as it leads to a complete loss of integrity for stored information within the affected Grav installation. Since the attacker can delete any file in the designated data directories, they can erase user-submitted forms, potentially causing significant disruption to business operations that rely on these inputs for lead generation or customer feedback. Furthermore, the ability to forge requests without CSRF checks means that this attack does not require complex social engineering tactics; it can be executed via simple automated scripts or even triggered through maliciously crafted links if a victim with administrative privileges were somehow tricked into loading them in an authenticated context, although the primary risk remains unauthenticated remote deletion.
To mitigate this vulnerability, administrators must immediately upgrade the Grav Data Manager plugin to version 1.4.6 or later where these authorization checks have been properly enforced and CSRF protections are correctly implemented for all state-changing operations. In addition to patching, it is advisable to review server-side logs for any signs of unauthorized deletion attempts during the window when vulnerable versions were in use. Implementing strict file permission settings on the user/data directory can also limit the blast radius by ensuring that even if an attacker gains write access, they cannot overwrite critical system files outside their designated scope. Regular security audits and adherence to OWASP guidelines for authentication and session management are recommended to prevent similar authorization bypasses in future deployments.