CVE-2026-58493

unknowncovered by 1 sourcefirst seen 2026-07-10

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.

⚡ Watch CVE-2026-58493

Get an email if CVE-2026-58493 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call bui…nvd · 2026-07-10

External references

NVD record for CVE-2026-58493

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-58493 status](https://www.csirts.com/badge/CVE-2026-58493)](https://www.csirts.com/cve/CVE-2026-58493)