The grav-plugin-database builds PDO DSN strings by concatenating user‑modifiable YAML values such as host, dbname, charset, and directory without any sanitization or validation. An attacker with administrative access to the plugin configuration can inject arbitrary DSN attributes or path traversal values, potentially causing the database connection to target unintended databases or files, thereby compromising database confidentiality and integrity.

All Grav CMS installations that use the grav-plugin-database plugin from vendor getgrav:grav and run any version prior to 1.2.0 are affected.

The CVSS score of 5.1 reflects moderate risk. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, indicating limited public exploitation at this time. Exploitation requires administrative access to the site’s plugin configuration, making it most relevant to internal adversaries or attackers who have compromised an admin account.