Which versions of Grav CMS are affected by CVE-2026-61873?

The Grav CMS Form plugin contains an authenticated arbitrary file write vulnerability (CVE-2026-61873, CVSS 7.2) affecting versions before 9.1.8 that allows authorized users to plant PHP webshells in…. A patch is available.

How to fix or mitigate CVE-2026-61873?

Within 24 hours, inventory all Grav CMS installations and identify those running Form plugin versions before 9.1.8, then cross-reference with active user accounts to assess exposure scope. Within 7 days, implement compensating controls: restrict Form plugin access via access control lists to verified administrators only, disable the plugin if not in active use, and enable comprehensive audit logging of all filename parameter submissions and file write operations. Within 30 days, establish monitoring of vendor advisories and GitHub releases for patch availability, develop and test an upgrade strategy to Grav CMS 9.1.8 or later in staging environments, and prioritize deployment for systems processing sensitive data.

Grav CMS CVE-2026-61873

Q: What is the CVSS score of CVE-2026-61873?

CVE-2026-61873 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44621 HIGH

External Control of File Name or Path (CWE-73)

2026-07-15 VulnCheck

GHSA-m8gp-46r6-rc3f

PHP Path Traversal Grav Getgrav

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable form submission with low complexity but requires a low-privileged account (PR:L); arbitrary file write yields High integrity and availability impact, with confidentiality None at base per the input.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:21 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

HIGH 7.2

DescriptionCVE.org

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to write arbitrary files including PHP webshells to the web root or other sensitive directories.

AnalysisAI

Authenticated arbitrary file write in the Grav CMS Form plugin (versions before 9.1.8) allows attackers to plant PHP webshells in the web root by abusing the process.save.filename parameter. The filename is checked for path traversal before Twig rendering but never re-validated afterward, so traversal sequences reconstructed during template evaluation bypass the guard. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the flaw was disclosed by VulnCheck via a coordinated GitHub security advisory.

Technical ContextAI

Grav is an open-source flat-file PHP CMS whose Form plugin lets site builders define forms that persist submissions to disk via a save action. The save filename supports Twig templating so it can be dynamically composed from submitted values. The defect is a CWE-73 (External Control of Filename or Path) time-of-check/time-of-use gap: input to process.save.filename is sanitized against '../' sequences before Twig processing, but Twig rendering can re-introduce or assemble those sequences (for example from concatenated form fields or Twig expressions), and the resulting rendered path is written without a second validation pass. Because the plugin ultimately writes attacker-influenced content to an attacker-influenced path within a PHP execution context, a resulting .php file dropped under the web root becomes a directly executable webshell.

RemediationAI

Vendor-released patch: 9.1.8 - upgrade Grav (and its bundled Form plugin) to 9.1.8 or later, which re-validates the rendered filename after Twig processing, per the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-q532-mvx7-42qg. Where immediate patching is not possible, restrict who can submit to form-save endpoints by tightening authentication and removing low-privilege access to pages using the save action, and audit form definitions to avoid Twig expressions in process.save.filename, pinning save filenames to server-controlled static values or a fixed directory outside the web root - the trade-off is loss of dynamic per-submission filenames. Additionally, deny PHP execution in user-writable/save-target directories at the web-server layer (an Apache/nginx rule preventing .php handling under those paths), which blocks webshell execution at the cost of breaking any legitimate PHP served from those locations. Finally, monitor form-save target directories for unexpected .php or executable files as a detective control.