CVE-2026-55885

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/getgrav/grav/releases/tag/1.7.53
https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf
https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Grav es una plataforma web basada en archivos. Antes de la 1.7.53, un administrador autenticado con permisos de copia de seguridad puede descargar un archivo ZIP que contiene la raíz completa de la instalación de Grav, incluyendo user/accounts/admin.yaml con el hash de la contraseña del administrador y user/config con la configuración del sitio, a través del endpoint de descarga de copias de seguridad protegido únicamente por el parámetro URL admin-nonce estático de la sesión. Este problema se informa como solucionado en la versión 1.7.53.

Information

Published : 2026-07-10 17:17

Updated : 2026-10-25 15:10

NVD link : CVE-2026-55885

Mitre link : CVE-2026-55885

CVE.ORG link : CVE-2026-55885

JSON object : View

Products Affected

No product.

CWE

CWE-312

Cleartext Storage of Sensitive Information

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-55885", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55885", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T01:57:32.723483Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "< 1.7.53"}]}]}], "published": "2026-07-10T17:17:00.273", "references": [{"url": "https://github.com/getgrav/grav/releases/tag/1.7.53", "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf", "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53."}, {"lang": "es", "value": "Grav es una plataforma web basada en archivos. Antes de la 1.7.53, un administrador autenticado con permisos de copia de seguridad puede descargar un archivo ZIP que contiene la ra\u00edz completa de la instalaci\u00f3n de Grav, incluyendo user/accounts/admin.yaml con el hash de la contrase\u00f1a del administrador y user/config con la configuraci\u00f3n del sitio, a trav\u00e9s del endpoint de descarga de copias de seguridad protegido \u00fanicamente por el par\u00e1metro URL admin-nonce est\u00e1tico de la sesi\u00f3n. Este problema se informa como solucionado en la versi\u00f3n 1.7.53."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}