CVE-2026-55885 is a cleartext storage and exposure vulnerability in the Grav web platform. Authenticated administrators with backup permissions can exploit the backup download endpoint to retrieve a ZIP archive containing the full Grav installation root, including sensitive files such as user/accounts/admin.yaml with administrator password hashes and user/config with site configuration data. The endpoint's protection relies solely on a session-static admin-nonce URL parameter, which is insufficient to prevent unauthorized access by authenticated users with backup rights. This vulnerability is resolved in Grav version 1.7.53.

An attacker with authenticated administrator access and backup permissions can obtain sensitive information including administrator password hashes and site configuration files. This exposure could facilitate further attacks such as offline password cracking or configuration manipulation. The vulnerability does not allow privilege escalation or denial of service directly but compromises confidentiality of sensitive data.

Upgrade Grav to version 1.7.53 or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Until upgrading, restrict backup permissions to trusted administrators only and monitor access to the backup download endpoint.