Grav Plugin Form
Monthly
Open redirect in Grav's form plugin (getgrav/grav-plugin-form) versions 9.1.11 through 9.1.12 allows unauthenticated form submitters to cause the server to issue a 302 redirect to an arbitrary external URL, enabling phishing attacks against site visitors. The vulnerability exists because the redirect process action, introduced in v9.1.11, evaluates user-supplied form field values through Twig expressions without sanitizing the resulting URL, and Grav::redirect() passes that output to the browser without origin validation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV, though the low attack complexity and zero-authentication requirement make this straightforward to abuse against any site with a susceptible form blueprint.
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. No public exploit or CISA KEV listing has been identified, but the zero-authentication, network-accessible vector makes this trivially exploitable once form names are known.
Open redirect in Grav's form plugin (getgrav/grav-plugin-form) versions 9.1.11 through 9.1.12 allows unauthenticated form submitters to cause the server to issue a 302 redirect to an arbitrary external URL, enabling phishing attacks against site visitors. The vulnerability exists because the redirect process action, introduced in v9.1.11, evaluates user-supplied form field values through Twig expressions without sanitizing the resulting URL, and Grav::redirect() passes that output to the browser without origin validation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV, though the low attack complexity and zero-authentication requirement make this straightforward to abuse against any site with a susceptible form blueprint.
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. No public exploit or CISA KEV listing has been identified, but the zero-authentication, network-accessible vector makes this trivially exploitable once form names are known.