Threats tagged 'ghsa-85vc-29fc-65gw'

An open redirect vulnerability exists in the Grav form plugin (getgrav/grav-plugin-form) before version 9.1.13. The vulnerability arises because the redirect process action evaluates user-supplied form data inside Twig expressions, and the Grav::redirect() function accepts external URLs without validating their origin. This allows an unauthenticated attacker submitting a form to supply a malicious URL, causing a 302 redirect to an arbitrary external site, which can facilitate phishing attacks.