EUVD-2026-44621
GHSA-m8gp-46r6-rc3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Grav form endpoint
-
DeliveryCraft form fields with traversal payload
-
ExploitTwig renders malicious save path
-
ExecutionBypass pre-render path check
-
PersistWrite PHP webshell to web root
-
ImpactRequest webshell for RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
| Exploitation Conditions | Exploitation requires (1) a Grav site running a version before 9.1.8, (2) a form defined with the Form plugin's process.save action enabled, and (3) the ability to submit to that form - the CVSS PR:L indicates low-level privileges are needed, so it is not fully anonymous unless the site exposes form-save to unauthenticated visitors. The attacker must craft form field values so that Twig rendering of process.save.filename produces path-traversal sequences (e.g. reconstructing '../') that were absent at the pre-render validation stage. Limiting factors: the target site must actually use a save-enabled form, the account must be permitted to submit it, and no victim user interaction is required (UI:N). If form-save is not configured or the endpoint is unreachable, the vulnerability is not exploitable. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H/VA:H, VC:N) scores 7.2 and is internally consistent with the description: network-reachable, low attack complexity, no user interaction, but requiring low-level privileges (PR:L) - i.e. an account able to submit to a form-save-enabled endpoint, not fully anonymous access. Integrity and availability impact are High (arbitrary file write / webshell) while confidentiality is rated None at the base level, though in practice a dropped webshell trivially escalates to full read access, so the real-world blast radius exceeds the base VC:N. No EPSS score, no SSVC decision, and no KEV/POC signal were provided, so exploitation probability cannot be quantified from the input. This is a credible priority for any Grav deployment that exposes form-save functionality to semi-trusted users because the endpoint of the chain is remote code execution; however, the PR:L requirement and dependence on a form configured with a save action meaningfully limit exposure versus a fully unauthenticated bug. Treat the base VC:N as understated given the webshell follow-on. |
| Exploit ScenarioDerived | A low-privileged authenticated user, or any actor who can reach a form configured with a save action, submits form data whose fields embed path-traversal sequences that Twig reassembles into a path such as ../../user/pages/shell.php. Because the rendered filename is never re-checked, Grav writes attacker-controlled content there, and the attacker then requests the dropped PHP file to obtain remote code execution. No public proof-of-concept was provided, and the low CVSS attack complexity indicates the write is reliable once the prerequisites are met. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Authenticated arbitrary file write in the Grav CMS Form plugin (versions before 9.1.8) allows attackers to plant PHP webshells in the web root by abusing the process.save.filename parameter. The filename is checked for path traversal before Twig rendering but never re-validated afterward, so traversal sequences reconstructed during template evaluation bypass the guard. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the flaw was disclosed by VulnCheck via a coordinated GitHub security advisory.
RemediationAI
Vendor-released patch: 9.1.8 - upgrade Grav (and its bundled Form plugin) to 9.1.8 or later, which re-validates the rendered filename after Twig processing, per the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-q532-mvx7-42qg. Where immediate patching is not possible, restrict who can submit to form-save endpoints by tightening authentication and removing low-privilege access to pages using the save action, and audit form definitions to avoid Twig expressions in process.save.filename, pinning save filenames to server-controlled static values or a fixed directory outside the web root - the trade-off is loss of dynamic per-submission filenames. Additionally, deny PHP execution in user-writable/save-target directories at the web-server layer (an Apache/nginx rule preventing .php handling under those paths), which blocks webshell execution at the cost of breaking any legitimate PHP served from those locations. Finally, monitor form-save target directories for unexpected .php or executable files as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is an open-source flat-file PHP CMS whose Form plugin lets site builders define forms that persist submissions to disk via a save action. The save filename supports Twig templating so it can be dynamically composed from submitted values. The defect is a CWE-73 (External Control of Filename or Path) time-of-check/time-of-use gap: input to process.save.filename is sanitized against '../' sequences before Twig processing, but Twig rendering can re-introduce or assemble those sequences (for example from concatenated form fields or Twig expressions), and the resulting rendered path is written without a second validation pass. Because the plugin ultimately writes attacker-influenced content to an attacker-influenced path within a PHP execution context, a resulting .php file dropped under the web root becomes a directly executable webshell.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable form submission with low complexity but requires a low-privileged account (PR:L); arbitrary file write yields High integrity and availability impact, with confidentiality None at base per the input.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to write arbitrary files including PHP webshells to the web root or other sensitive directories.
Executive ViewAI
The Grav CMS Form plugin contains an authenticated arbitrary file write vulnerability (CVE-2026-61873, CVSS 7.2) affecting versions before 9.1.8 that allows authorized users to plant PHP webshells in the application root, enabling remote code execution. Organizations using this plugin face insider threat and credential compromise risks; any exposed administrative account could trigger full system compromise. No patch is currently available, requiring immediate compensating controls pending vendor resolution.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Form plugin access through access control lists to verified administrators; (2) Disable the plugin if not actively required; (3) Implement Web Application Firewall rules to detect and block requests with suspicious filename parameter values; (4) Enable detailed audit logging of form submissions and file operations; (5) Monitor vendor announcements for patch release; (6) Minimize accounts with form plugin permissions to reduce attack surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB