CVE-2026-109316: Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. The attacker needs to know a valid data type and the filename of a stored data file to target.
What data is at risk of deletion?
Files stored under user/data/ can be deleted, including form submissions. The described impact is deletion of stored data files rather than disclosure of their contents.
Are CSRF protections sufficient to prevent exploitation?
No. The issue includes requests that lack CSRF nonce checks, and the described authorization weakness permits unauthenticated deletion through the classic Admin integration.
How can I determine whether my deployment is affected?
Deployments using the Grav Data Manager plugin versions 1.4.0 through 1.4.5 are affected according to the advisory data. Review whether the classic Admin integration is enabled and whether data files are stored under user/data/.