https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:27:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336208 EUVD-2026-336208 https://cve.radiocsirt.org/vuln/euvd-2026-336208 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55885 <p>Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.</p> <p>Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55885 https://cve.radiocsirt.org/vuln/ghsa-2f86-9cp8-6hcf <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary An authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including `user/accounts/admin.yaml` with the admin&#39;s bcrypt password hash and email, plus `user/config/` with all site configuration. The download endpoint requires only the session-static `admin-nonce` in the URL, no additional form-level CSRF token, and reveals the server&#39;s full filesystem path in a Base64-encoded query parameter. Combined with the absence of login rate limiting on `http://{Grav_URL}/admin`, an attacker who obtains a single admin-nonce value (via Referrer leakage, browser history, or XSS) can exfiltrate password hashes for offline cracking and achieve account takeover.</p> <p>### Details The vulnerability chain spans three components in the deployed Grav source tree at `/var/www/html/grav/`:</p> <p>**1. Backup archive scope — `Backups::backup()`** `/var/www/html/grav/system/src/Grav/Common/Backup/Backups.php:201-272`</p> <p>The `backup()` static method creates a ZIP of the directory specified by the backup profile&#39;s `root` property. The default profile (ID `0`, named `default_site_backup`) backs up the entire Grav root directory. On line 225, when the root is not a stream URI, it falls back to the full installation path:</p> <p>```php // Backups.php:225 $backup_root = rtrim(GRAV_ROOT . $backup-&gt;root, DS) ?: DS; ```</p> <p>Since the default profile ships with no `root` override, `$backup-&gt;root` is empty, making `$backup_root` equal to `GRAV_ROOT` —…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary An authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including `user/accounts/admin.yaml` with the admin&#39;s bcrypt password hash and email, plus `user/config/` with all site configuration. The download endpoint requires only the session-static `admin-nonce` in the URL, no additional form-level CSRF token, and reveals the server&#39;s full filesystem path in a Base64-encoded query parameter. Combined with the absence of login rate limiting on `http://{Grav_URL}/admin`, an attacker who obtains a single admin-nonce value (via Referrer leakage, browser history, or XSS) can exfiltrate password hashes for offline cracking and achieve account takeover.</p> <p>### Details The vulnerability chain spans three components in the deployed Grav source tree at `/var/www/html/grav/`:</p> <p>**1. Backup archive scope — `Backups::backup()`** `/var/www/html/grav/system/src/Grav/Common/Backup/Backups.php:201-272`</p> <p>The `backup()` static method creates a ZIP of the directory specified by the backup profile&#39;s `root` property. The default profile (ID `0`, named `default_site_backup`) backs up the entire Grav root directory. On line 225, when the root is not a stream URI, it falls back to the full installation path:</p> <p>```php // Backups.php:225 $backup_root = rtrim(GRAV_ROOT . $backup-&gt;root, DS) ?: DS; ```</p> <p>Since the default profile ships with no `root` override, `$backup-&gt;root` is empty, making `$backup_root` equal to `GRAV_ROOT` —…</p> https://cve.radiocsirt.org/vuln/ghsa-2f86-9cp8-6hcf