CVE-2026-58492CWE-89

grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation

Critical · published July 10, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00525 · 43.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-10T16:22Z
EPSS history
Timeline
  • 10 JUL 16:22Z
    grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation
    cvelistv5