The grav-plugin-database component of Grav CMS versions before 1.2.0 constructs PDO DSN connection strings by concatenating user-configurable YAML fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation. This improper neutralization of special elements (CWE-74) enables an administrator with access to plugin configuration to inject DSN attributes or path traversal sequences, potentially altering database connection behavior or file paths. The vulnerability is addressed in version 1.2.0.

An administrator with plugin configuration access can exploit this vulnerability to inject malicious DSN attributes or path traversal values, which may lead to unintended database connections or file system access. The CVSS 4.0 score is 5.1 (medium severity), reflecting that exploitation requires high privileges and no user interaction, with low impact on confidentiality and integrity and no impact on availability.

Upgrade the grav-plugin-database plugin to version 1.2.0 or later, where this issue is fixed. There is no official patch advisory beyond this version update. Until upgraded, restrict administrative access to trusted users only to minimize risk.