CVE-2026-58492
CriticalCVSS 9.2Summary
The database plugin for Grav CMS prior to version 1.2.0 contains an SQL injection vulnerability in the PDO::tableExists method. The table name passed by plugin or developer code is directly interpolated into a raw SQL query without sanitization, allowing arbitrary SQL execution.
Risk Assessment
An attacker can exploit this vulnerability to perform unauthorized database operations such as reading, modifying, or deleting data, potentially compromising the confidentiality and integrity of the organization's data.
Recommendation
Immediately update the grav-plugin-database plugin to version 1.2.0 or later, which includes a fix for the SQL injection vulnerability.
Original NVD description (English source)
grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.