P4Verified

CVE-2026-56707: grav 0 to before 1.4.8

CVE-2026-56707. CVSS 3.1 base score 7.7 (HIGH, Vendor/CNA). EPSS 0.00375 (percentile 0.29533), scored 11-Oct-2026.

Affected technology

grav · 0 to before 1.4.8
getgrav

Description’s affected range: versions 1.4.0 through 1.4.7

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel. Vendor/CNA’s CVSS 4.0 assessment (base score 8.3/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 12-Oct-2026 16:54 UTC

CWE: CWE-862
CCR priority: 30.9 /100 (P4)
CVSS 3.1: 7.7 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · Vendor/CNA
EPSS: 0.00375 · percentile 0.29533 · 2026-10-11
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-12 16:54:24.294989+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-56707.html