CVE-2026-61873 affects Grav CMS before version 9.1.8. The vulnerability is in the Form plugin's process.save.filename parameter, which is intended to prevent path traversal attacks by validating input before Twig template processing. However, after Twig rendering, the parameter is not re-validated, enabling attackers to bypass the initial validation. This results in an arbitrary file write vulnerability, allowing malicious users to write files anywhere on the server accessible to the web process, including executable PHP files. The CVSS 4.0 score is 7.2, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on integrity and availability.

Successful exploitation allows an attacker with low privileges to write arbitrary files on the server, including PHP webshells, which can lead to remote code execution and full compromise of the affected system. This compromises the integrity and availability of the application and potentially the entire server hosting Grav CMS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Form plugin and validate or sanitize inputs that control file paths. Monitor for suspicious file writes in web-accessible directories. Avoid exposing the vulnerable versions in public-facing environments.