The Grav CMS form plugin before version 9.1.0 contains an unauthenticated external control of file name or path vulnerability (CWE-73) that allows attackers to overwrite page content by uploading files with manipulated filenames. The plugin's permissive accept policy combined with the default destination setting ('self@') could be exploited to overwrite .md files and escalate privileges via a process save action. The fix in 9.1.0 enforces filename sanitization by removing path components and hard-blocking dangerous extensions such as md, yaml, yml, json, twig, and ini.

An unauthenticated attacker can overwrite page content files, potentially leading to privilege escalation to super-admin by leveraging the ability to save manipulated content. This compromises the integrity of the CMS content and could lead to full site compromise if exploited.

Upgrade grav-plugin-form to version 9.1.0 or later, where this vulnerability is fixed by proper filename sanitization and blocking of dangerous extensions. No other mitigations are indicated or required beyond applying this official fix.