CVE-2026-109316 — Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Adm…
Published: 2026-10-12 · CVSS: 6.9 · CVSS 4.0
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7