Grav is a file‑based web platform. Before version 1.7.53, an authenticated administrator who has been granted backup permissions can download a ZIP archive containing the entire Grav installation root, including user/accounts/admin.yaml where the administrator password hash and user/config holding the site configuration are stored. The backup download endpoint is protected only by a session‑static admin‑nonce URL parameter. Based on the description, it is inferred that the static admin‑nonce could potentially be guessed or discovered, allowing an administrator session to retrieve the ZIP file. This flaw exposes critical credentials and configuration data, mapping to CWE‑312 and CWE‑522, and results in a confidentiality breach of sensitive information.

All installations of the Grav file‑based web platform running any version before 1.7.53 are affected. Users with administrative roles who have been granted backup permissions can trigger the vulnerable endpoint. The product is managed by getgrav and is identified as Grav.

The CVSS score of 6.8 indicates medium severity. The EPSS score is < 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no large‑scale observed attacks. Exploitation requires an authenticated administrator session that holds backup permissions and knowledge of the static admin‑nonce value or, based on the description, an inference that the static admin‑nonce could potentially be guessed. Once the ZIP archive is retrieved, the attacker can obtain password hashes and configuration secrets, resulting in a confidentiality breach of credential and configuration data.