CVE-2026-109316

Executive Summary

CVE-2026-109316 is a missing authorization vulnerability (CWE-862) in the Grav Data Manager plugin, affecting versions 1.4.0 through 1.4.5. Unauthenticated attackers can delete stored data files under user/data/—including form submissions—by sending a request that leverages the plugin's classic Admin integration with a delete parameter and a known data type and filename, and can further forge requests because the endpoint lacks CSRF nonce validation. With a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), the vulnerability poses a moderate but externally reachable integrity and availability risk to any Grav site running the affected plugin versions.

Technical Analysis

The Grav Data Manager plugin exposes functionality through Grav's classic Admin integration. The core flaw is a missing authorization check (CWE-862): the delete operation does not verify that the requester is authenticated or holds the required privileges before acting on a data file. Because the classic Admin integration is reachable over the network (AV:N) and requires no privileges (PR:N) and no user interaction (UI:N), an attacker can directly invoke the deletion logic by supplying a delete parameter along with a known data type and filename.

The attack surface centers on the plugin's handling of data files stored under user/data/. Per the NVD description, these files include form submissions. Two distinct weaknesses compound the issue:

1. Absent authorization: The delete path performs no session, capability, or role check, so an unauthenticated request reaches the destructive logic directly.
2. CSRF nonce bypass: The endpoint also accepts forged requests that lack a valid CSRF nonce. This means even if a victim admin were authenticated, an attacker could craft a cross-site request that the server processes, and it also means the unauthenticated direct request is not blocked by nonce enforcement.

The CVSS vector (C:N/I:L/A:L) reflects that confidentiality is not affected—the flaw does not read or exfiltrate data—while integrity and availability are partially impacted through unauthorized file deletion. No specific function names, class names, or additional endpoints are disclosed in the available intelligence, so the exact code path cannot be enumerated beyond the delete parameter, the data type/filename inputs, and the user/data/ storage location cited in the description.

Exploitation Scenarios

No public PoC or exploit code is available (PoC status: None); the attack chain below is inferred from the vulnerability class and the NVD description only.

1. Reconnaissance / target identification: An attacker identifies Grav sites running the Data Manager plugin in the 1.4.0–1.4.5 range, for example via fingerprinting the classic Admin integration or the plugin's exposed data-handling surface. The attacker enumerates plausible data types and filenames, since deletion requires a "known data type and filename."

2. Triggering the flaw: The attacker sends a request to the plugin's delete functionality containing the delete parameter together with a data type and filename. Because the operation lacks an authorization check, no authentication is required, and because CSRF nonce checks are absent, the request does not need to carry a valid nonce.

3. Payload / execution (class level): This is a missing-authorization destructive action, not code execution. The "payload" is simply a crafted request that names a target file. Exploitation succeeds when the attacker supplies a valid data type and an existing filename; no memory corruption, injection, or privilege escalation primitive is involved.

4. Post-exploitation impact: Successful requests delete files under user/data/, including stored form submissions. This yields data loss and potential disruption to site functionality that depends on those files. There is no indicated path to data theft (C:N) or to full system compromise.

Impact Assessment

The business impact is loss of stored data integrity and availability. Organizations using Grav with the affected Data Manager plugin versions may lose form submissions and other files under user/data/, which can translate to lost leads, corrupted records, and broken downstream workflows that consume that data. The CVSS subscores—Confidentiality: None, Integrity: Low, Availability: Low—indicate the impact is bounded to modification/deletion of data rather than disclosure or full outage. The attack is network-reachable with low complexity and no privileges or user interaction, so the effective risk is elevated despite the moderate base score of 6.5. Blast radius is limited to Grav instances running the plugin in the affected range; the plugin appears to be third-party rather than core Grav, narrowing exposure but concentrating risk on sites that depend on it for data collection.

Detection Guidance

Sigma Rule

title: Grav Data Manager Unauthenticated File Deletion Attempt (CVE-2026-109316)
id: 8f3c2b1a-7d4e-4a9b-9c1f-2e6a5d0b7c44
status: experimental
description: Detects requests attempting to delete data files via the Grav Data Manager plugin without authorization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109316
author: SOC Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_param:
    cs-uri-query|contains: 'delete='
  selection_path:
    cs-uri-query|contains:
      - 'type='
      - 'filename='
  condition: selection_method and selection_param and selection_path
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate authenticated administrative deletions
level: high
tags:
  - attack.t1190
  - cve.2026.109316

YARA Rule

rule CVE_2026_109316_Grav_DataManager_Delete
{
    meta:
        description = "Detects references to unauthenticated Grav Data Manager delete activity"
        author = "SOC Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109316"
        date = "2026-01-01"
        severity = "high"

    strings:
        $plugin = "datamanager" nocase
        $del    = "delete" nocase
        $path   = "user/data/" nocase
        $nonce  = "nonce" nocase

    condition:
        uint16(0) != 0x5A4D and
        filesize < 2MB and
        $plugin and $del and $path and not $nonce
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109316 Grav Data Manager Unauthenticated File Deletion Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"delete="; nocase; http.uri; content:"filename="; nocase; http.uri; content:"type="; nocase; classtype:attempted-user; sid:2026109316; rev:1; reference:cve,2026-109316; metadata:affected_product Grav_Data_Manager, attack_target Web_Server, created_at 2026_01_01, cve CVE_2026_109316;)

Elastic Detection

network where
  http.request.method == "GET" and
  stringContains(http.request.uri, "delete=") and
  stringContains(http.request.uri, "filename=") and
  (stringContains(http.request.uri, "type=") or stringContains(http.request.uri, "datamanager"))

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| where (like(uri_lower, "%delete=%") AND like(uri_lower, "%filename=%") AND (like(uri_lower, "%type=%") OR like(uri_lower, "%datamanager%")))
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips values(uri) as requested_uris by host
| sort - count

Wazuh OSSEC Rule

<group name="web,grav,datamanager,">
  <rule id="2026109" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>delete=</url>
    <description>CVE-2026-109316: Possible unauthenticated Grav Data Manager file deletion attempt</description>
    <group>cve_2026_109316,attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Disable or remove the Grav Data Manager plugin on production sites until a fixed release is available, since no vendor fix or workaround is published. If the plugin cannot be removed, restrict access to the affected endpoint at the reverse proxy or WAF layer (block requests containing the delete parameter targeting the plugin's data-handling surface) and ensure the classic Admin integration is not exposed to untrusted networks. Because CSRF nonce checks are absent, standard CSRF defenses at the application layer cannot be relied upon here.

2. Patch/upgrade steps: There is currently no patched version to upgrade to—versions 1.4.0 through 1.4.5 are all affected and no fixed release has been identified. Monitor the plugin's vendor/repository advisory channels and the NVD entry for an updated version, then upgrade immediately when released and verify the delete endpoint enforces authentication and nonce validation.

3. Long-term hardening: Enforce authorization and CSRF nonce validation on all state-changing plugin endpoints as a baseline; adopt least-privilege access to user/data/ storage; implement file-integrity monitoring and backups for data directories to detect and recover from unauthorized deletions; and maintain a software bill of materials to track third-party Grav plugins so vulnerable components can be identified quickly.

References

• NVD — CVE-2026-109316: https://nvd.nist.gov/vuln/detail/CVE-2026-109316
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Grav official project site / plugin repository (monitor for advisory): https://getgrav.org
• FIRST EPSS (not yet scored as of report date): https://www.first.org/epss

No public exploit code, Nuclei template, or confirmed exploit-in-the-wild activity was identified for CVE-2026-109316 at the time of writing.