CVE-2026-58493

21th percentile - higher than 21% of all known CVEs

The database plugin for Grav CMS prior to version 1.2.0 contains a vulnerability due to unsafe construction of PDO DSN strings. The Database::__call method directly concatenates user-configurable YAML values (such as host, dbname, charset, server, database, directory, filename) without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values.

The risk involves the ability of a privileged administrator to modify the database connection, potentially leading to unauthorized data access, privilege escalation, or attacks on other systems through manipulation of DSN parameters.

Immediately update the grav-plugin-database plugin to version 1.2.0 or later, which contains the fix. After updating, verify the database connection configuration.