medium6.5
CVE-2026-109316
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files v…
Impact
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.
Affected products
| Product | Affected versions |
|---|---|
| Grav Data Manager Plugin 1.4.0 | through 1.4.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.