EUVD-2026-52280
GHSA-85vc-29fc-65gw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the prerequisite that a form blueprint must use user-controlled Twig interpolation in the redirect target; UI:R because the victim must follow the redirect for phishing impact; I:L captures the URL integrity violation with no direct server confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. When a form blueprint defines a redirect target such as redirect: "{{ form.value('next') }}" using an attacker-controllable field, an unauthenticated form submitter can supply a value like https://evil.com to cause a 302 redirect to an arbitrary external site, enabling phishing.
AnalysisAI
Open redirect in Grav's form plugin (getgrav/grav-plugin-form) versions 9.1.11 through 9.1.12 allows unauthenticated form submitters to cause the server to issue a 302 redirect to an arbitrary external URL, enabling phishing attacks against site visitors. The vulnerability exists because the redirect process action, introduced in v9.1.11, evaluates user-supplied form field values through Twig expressions without sanitizing the resulting URL, and Grav::redirect() passes that output to the browser without origin validation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV, though the low attack complexity and zero-authentication requirement make this straightforward to abuse against any site with a susceptible form blueprint.
Technical ContextAI
Grav is a flat-file PHP CMS that uses the Twig templating engine for dynamic content rendering. The form plugin (CPE: cpe:2.3:a:getgrav:grav-plugin-form:*:*:*:*:*:*:*:*) provides form processing capabilities, including a 'redirect' process action that executes after form submission. Beginning with v9.1.11, that action passes redirect target strings through Twig evaluation before dispatching them to Grav::redirect(). The root cause is CWE-601 (URL Redirection to Untrusted Site, 'Open Redirect'): when a form blueprint declares a redirect target as a Twig expression referencing a user-controlled field - such as redirect: "{{ form.value('next') }}" - the Twig evaluator resolves that expression to whatever value the submitter supplied, and Grav::redirect() dispatches it as a 302 Location header with no scheme or host validation to enforce same-origin constraints.
RemediationAI
Upgrade grav-plugin-form to version 9.1.13 or later, which is the vendor-confirmed patched release per the advisory at https://github.com/getgrav/grav/security/advisories/GHSA-j2j9-gp72-wqvm. The VulnCheck advisory at https://www.vulncheck.com/advisories/grav-form-plugin-before-open-redirect-via-form-value-twig corroborates the fix boundary. If an immediate upgrade is not possible, the most effective compensating control is to audit all form blueprints and replace any redirect targets that interpolate user-supplied field values (e.g., redirect: "{{ form.value('next') }}") with hardcoded relative paths or a server-side allowlist of permitted destination URLs - this eliminates the injection point entirely without disabling the redirect feature. A secondary control is to implement a server-side middleware or Grav hook that validates the redirect destination against an allowlist of trusted origins before Grav::redirect() is called; however, this requires custom plugin development and carries a risk of incomplete coverage if new forms are added later without updating the allowlist. Disabling the form plugin entirely is the highest-assurance workaround but will break all form-based functionality on the site.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today