Threat Intelligence Database

An open redirect vulnerability exists in the Grav form plugin (getgrav/grav-plugin-form) before version 9.1.13. The vulnerability arises because the redirect process action evaluates user-supplied form data inside Twig expressions, and the Grav::redirect() function accepts external URLs without validating their origin. This allows an unauthenticated attacker submitting a form to supply a malicious URL, causing a 302 redirect to an arbitrary external site, which can facilitate phishing attacks.

CVE-2026-42845 is a high-severity vulnerability in the Grav CMS form plugin (grav-plugin-form) versions prior to 9.1.0. It allows unauthenticated attackers to overwrite page content via crafted file uploads due to insufficient sanitization of uploaded filenames. This could enable an attacker to overwrite the page's own markdown (. md) files and potentially escalate privileges to super-admin through a subsequent save action. The vulnerability is fixed in version 9.1.0 by stripping path components from filenames and blocking critical page-content extensions regardless of configuration.