CVE-2026-55885 Details
Description
Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.
A vulnerability in Grav versions prior to 1.7.53 allows authenticated administrators with backup permissions to download a ZIP archive containing the full Grav installation root. This archive includes sensitive files such as 'user/accounts/admin.yaml', which holds the administrator's password hash and email, and 'user/config', which contains site configuration details. The backup download endpoint is inadequately protected, requiring only a session-static 'admin-nonce' URL parameter, and exposes the server's full filesystem path in a Base64-encoded query parameter. This vulnerability could be exploited by an attacker who obtains a single 'admin-nonce' value, potentially leading to unauthorized access to admin accounts by exfiltrating and cracking password hashes.
Users can update to Grav version 1.7.53, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/releases/tag/1.7.53 | [email protected] | Release NotesVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | 1.7.52 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |