Grav Form Plugin EUVD-2026-71996

Exploitation requires that the target Grav installation has at least one form defined on a login-restricted or unpublished page with at least one actionable handler (save, upload, email, or call). The attacker must know or successfully guess the form name string (defined in the page's YAML front matter). No authentication, user interaction, or privileged network position is required - the attack executes over standard HTTP POST to any publicly reachable URL of the Grav installation. The severity of impact is configuration-dependent: file upload actions present the highest risk (server-side file write, potential RCE), email actions enable spam relay, and save actions allow data injection. Sites where restricted pages contain no sensitive form actions face substantially reduced practical risk despite the authentication bypass.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely exploitable by unauthenticated attackers with no special prerequisites, and the score of 6.9 reflects moderate confidentiality and integrity impact (VC:L/VI:L). However, real-world impact varies significantly based on what actions are configured on restricted forms: file upload actions could allow server-side file writes that escalate to code execution via a webshell, while email actions enable spam relay or information leakage, and save actions permit unauthorized data injection into the application. No EPSS score, CISA KEV listing, or public proof-of-concept has been identified in the provided data; exploitation status is therefore unconfirmed. Even a mid-sized municipal IT team in inowroclaw should treat this as urgent if any restricted pages configure upload or call actions, since those scenarios substantially exceed what the base CVSS score conveys. Sites whose restricted forms use only non-destructive actions (e.g., display-only) face substantially lower risk.

An attacker browses the Grav site to enumerate publicly visible pages, infers or guesses form names from page source or common Grav naming conventions (form names are defined in plaintext YAML front matter and may be predictable), then crafts an HTTP POST request to any accessible public page specifying a restricted form's name as the form target. The plugin resolves the named form cross-page and executes its configured actions - such as writing an uploaded file to the server filesystem - without performing any authorization check, potentially allowing the attacker to deposit a PHP webshell if an upload action is configured on the restricted page.