The Grav Data Manager plugin for Grav CMS, versions 1.4.0 through 1.4.5, allows an attacker without authentication to delete arbitrary files in the user/data/ directory via the Admin interface. By sending a request that includes a delete flag, a known data type, and a filename, a malicious actor can remove stored data such as form submissions or other user data. This flaw is a CWE‑862 missing authorization issue that can compromise data integrity. It does not affect confidentiality or availability directly, but loss of user‑generated content can result in business disruption and data loss.

Any Grav CMS installation that has the Grav Data Manager plugin v1.4.0 to v1.4.5 from getgrav. The plugin ships with the Grav CMS and may be included in sites. The relevant component is the admin integration accessible at /admin/. Sites without the plugin or with versions outside this range are unaffected.

The CVSS score of 6.9 suggests moderate severity. No EPSS score is available, and the vulnerability is not present in the CISA KEV list. The likely attack vector is an unauthenticated HTTP request directed at the /admin/ endpoint with the appropriate delete parameters, data type, and filename. The exploit does not require elevated privileges and can be performed by sending a crafted HTTP request with the delete parameter, known data type, and filename. Because the plug‑in exposes the delete functionality through a public endpoint, the attack can be executed from anywhere the attacker can send HTTP requests to the site, increasing the potential threat surface.