CVE-2026-42845

Summary

The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (md, yaml, yml, json, twig, ini) regardless of the configurable dangerous-extensions list. A permissive accept policy combined with the default destination: self@ could otherwise let an attacker overwrite the page's own .md and pivot to super-admin via a process: save action. This vulnerability is fixed in 9.1.0.

Affected Software

Weaknesses

• CWE-73: CWE-73: External Control of File Name or Path

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/getgrav/grav/security/advisories/GHSA-w4rc-p66m-x6qq

References

• https://github.com/getgrav/grav/security/advisories/GHSA-w4rc-p66m-x6qq
• https://github.com/getgrav/grav-plugin-form/commit/48bacc4187e1cff815000e526d5ca2878484867f

• ←Previous
• Next→