CVE-2026-109316 | BDVDB-2026-386362 Detail

Description#

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-12Record published in the CVE List.
2. Version 22026-10-18Most recent update recorded in the CVE List.