CVE-2026-109316
Received Received - Intake

Unauthenticated File Deletion in Grav Data Manager Plugin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109316
EUVD
EUVD-2026-97618

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-data-manager 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Grav Data Manager plugin versions 1.4.0 to 1.4.5 has a missing authorization vulnerability. Unauthenticated attackers can delete stored data files by sending a request with the delete parameter, a known data type, and filename. This allows removal of files in the user/data/ directory, including form submissions. The vulnerability also involves missing CSRF nonce checks, enabling forged requests.

Detection Guidance

Check for unauthorized file deletions in Grav Data Manager plugin logs or network traffic. Look for requests containing the 'delete' parameter targeting user/data/ files. Monitor for missing CSRF nonce checks in admin requests.

Impact Analysis

This vulnerability allows attackers to delete critical data files without authentication. If exploited, it could lead to loss of form submissions, user data, or other stored information. The impact includes data integrity breaches and potential disruption of services relying on the Grav Data Manager plugin.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by enabling unauthorized data deletion. GDPR requires data integrity and protection, while HIPAA mandates safeguards for protected health information. Exploitation may lead to non-compliance, legal penalties, or loss of trust due to compromised data availability.

Mitigation Strategies

Update Grav Data Manager plugin to the latest version. Implement strict access controls to prevent unauthenticated delete requests. Add CSRF protection to admin integrations. Review and restrict file deletion permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart