CVE-2026-61873 is an arbitrary file write vulnerability in Grav CMS before version 9.1.8. The issue exists in the Form plugin's process.save.filename parameter, which is initially validated to prevent path traversal but is not re-validated after being processed through Twig templates. This flaw allows attackers to submit form data containing path traversal sequences that, after Twig rendering, can result in writing files to arbitrary locations such as the web root. This can be exploited to upload malicious files like PHP webshells, leading to remote code execution or full system compromise. The vulnerability has a CVSS 4.0 score of 7.2, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high impact on integrity and availability.

Successful exploitation allows an attacker with low privileges to write arbitrary files to the server, including placing PHP webshells in the web root or other sensitive directories. This can lead to remote code execution, full system compromise, data loss, or service disruption. The vulnerability affects the integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Form plugin and validate or sanitize inputs to prevent path traversal and template injection. Monitor for suspicious file writes and consider disabling the vulnerable functionality if feasible.