CVE-2026-55885: Grav Backup Download Vulnerability Allows Unauthorized Access to Admin Credentials

Technical summary

CVE-2026-55885 affects the backup download functionality in Grav prior to version 1.7.53. The vulnerability exists because the backup endpoint relies solely on a session-static admin-nonce URL parameter for protection, without enforcing additional authorization controls. An authenticated administrator possessing backup permissions can bypass granular access controls to download a ZIP archive of the complete Grav installation root. The archive contents include user/accounts/admin.yaml (containing administrator password hashes) and user/config (containing site configuration), both of which may contain sensitive authentication and system information. The issue is rooted in insufficient secrets management and weak backup endpoint authorization (CWE-312, CWE-522).

Business impact

Exposure of administrator password hashes and site configuration through backup archives creates a multi-stage attack surface. An administrator with backup permissions who turns malicious—or whose account is compromised—can extract authentication credentials and configuration details for offline cracking, credential reuse, or reconnaissance. This is particularly damaging in multi-tenant or managed Grav hosting environments where site operators may not audit backup access logs. The confidentiality impact is high; unauthorized disclosure of password hashes and configuration can lead to unauthorized site access, data theft, and supply-chain risks if the compromised Grav instance serves as a content platform for downstream users.

Affected systems

Grav versions prior to 1.7.53 are vulnerable. Any Grav installation running 1.7.52 or earlier with administrators or backup operators who have not been carefully vetted or whose accounts are at elevated risk of compromise is in scope. The vulnerability requires both authentication and backup permission, so unauthenticated attackers cannot exploit it directly. Organizations using Grav as a static site generator or file-based CMS for internal or external content should prioritize inventory and version assessment.

Exploitability

Exploitation requires a valid administrator account with backup permissions, making this a privileged-insider or account-compromise scenario rather than an unauthenticated remote attack. An attacker cannot exploit this vulnerability from the internet without first obtaining valid administrative credentials. However, once inside, the attack is trivial: a single download request to the backup endpoint yields the full secrets archive. The barrier to exploitation is authentication; the technical barrier is nearly zero. In environments with weak password policies, compromised admin credentials, or overly permissive backup role assignments, risk is elevated.

Remediation

Update Grav to version 1.7.53 or later immediately. Verify against the official Grav release notes and security advisories to confirm patch details and any workarounds. In parallel, audit and restrict backup permissions to only users who absolutely require them. Implement additional monitoring of backup download activity and audit logs. If you cannot patch immediately, consider temporarily disabling the backup download feature or restricting network access to the admin panel. Review administrator account credentials and enable multi-factor authentication if available.

Patch guidance

1. Update Grav to version 1.7.53 or later. Consult the official Grav project repository and release notes for verification and any breaking changes. 2. Test the patch in a staging environment before deploying to production. 3. After patching, review backup access logs to identify any unauthorized or suspicious downloads since the vulnerability disclosure date (2026-07-10). 4. Ensure all administrator accounts have strong, unique passwords and consider rotating them as a precautionary measure. 5. If running a managed Grav hosting platform, communicate the availability of the patch to all customers and encourage immediate adoption.

Detection guidance

Monitor backup endpoint access logs for requests to the backup download function by users with backup permissions. Look for anomalous timing (off-hours downloads), geographic anomalies, or repeated downloads in short time windows. Log the admin-nonce parameter values to detect reuse or parameter tampering. Implement alerting on any successful backup download, especially if multi-factor authentication is not enforced. Compare backup archives downloaded before and after 2026-07-10 to identify whether sensitive files (admin.yaml, config) have been extracted. Network-based detection can flag unusual file transfers from web servers containing password hashes or configuration data in backup formats.

Why prioritize this

Although the CVSS score of 6.8 (Medium) reflects the authentication requirement, the practical risk is substantial. Administrator password hashes and configuration files are high-value targets for attackers. Compromise of this data can lead to account takeover, site defacement, or use of the Grav instance as a pivot point in supply-chain attacks. Organizations operating Grav in production or multi-tenant environments should treat this as high priority due to confidentiality impact and the potential for lateral movement. The lack of additional authorization on the backup endpoint (beyond session validation) is a design flaw that warrants urgent patching.

Risk score, explained

CVSS 3.1 score of 6.8 reflects: (1) Network-accessible attack vector (AV:N), (2) Low attack complexity (AC:L) once authenticated, (3) High privilege requirement (PR:H) limiting the threat actor pool, (4) No user interaction required (UI:N), (5) Changed scope (S:C) due to potential impact on downstream services relying on the Grav instance, (6) High confidentiality impact (C:H) from exposure of hashes and config, (7) No integrity or availability impact. The Medium severity understates practical risk in production environments with multiple administrators or in hosting scenarios.

Frequently asked questions