Insufficiently Protected Credentials Affecting getgrav/grav package, versions <1.7.53
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-GETGRAVGRAV-17660426
- published27 Jun 2026
- disclosed18 Jun 2026
- creditnicl4ssic
Introduced: 18 Jun 2026
NewCVE-2026-55885 (opens in a new tab)How to fix?
Upgrade getgrav/grav to version 1.7.53 or higher.
Overview
getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS.
Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the backup process. An attacker can obtain sensitive account credentials and configuration secrets by leveraging access to a valid admin-nonce value, which can be acquired through methods such as Referrer leakage, browser history, or XSS. This enables exfiltration of password hashes for offline cracking and potential account takeover. The download endpoint also reveals the server's full filesystem path in a Base64-encoded query parameter, increasing the risk of further attacks.