CVE-2026-42845: Grav Form Plugin unauthenticated page-content overwrite via file upload

CVE-2026-42845 · Severity: high · CVSS 4 · Published 2026-05-11

The Grav Form plugin, used to handle user-submitted forms on Grav CMS websites, contains a vulnerability that allows unauthenticated visitors to overwrite website content. By uploading a specially crafted file, an attacker can replace existing page definitions with their own. This can be used to hijack site functionality or create new administrative accounts, leading to a full takeover of the website.

Technologies: Grav Form Plugin. Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42845 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42845 being exploited in the wild.
How severe is CVE-2026-42845?
High severity, with a CVSS score of 4, published 11 May 2026.
Which products and versions are affected?
Grav Form Plugin < 9.1.0; getgrav/grav-plugin-form (Packagist) < 9.1.0, ECOSYSTEM:introduced=0,fixed=9.1.0.
Is there a fix for CVE-2026-42845?
Yes. getgrav/grav-plugin-form (Packagist): upgrade to 9.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42845 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42845?
Check whether you run Grav Form Plugin or getgrav/grav-plugin-form (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav-plugin-form (Packagist): upgrade to 9.1.0 or later
    composer require getgrav/grav-plugin-form:^9.1.0

Technical details

The Form plugin's file upload handler in `Form.php` accepts a user-supplied `filename` parameter that overrides the original uploaded filename. While the plugin uses `Utils::checkFilename()` to block dangerous extensions like `.php`, it does not block Markdown (`.md`) or YAML files. When a form is configured to accept all file types (`accept: ['*']`) and uses the `self@` destination, an unauthenticated attacker can provide a `filename` that matches the page's own content file (e.g., `form.md`). The `moveTo()` function subsequently overwrites the existing page file with the attacker's content. Since Grav pages define logic and frontmatter in these files, an attacker can redefine the page to execute administrative actions, such as creating a new super-admin user. This is fixed in version 9.1.0.

Affected products

  • getgrav grav-plugin-form < 9.1.0

Identifiers

  • CVE-2026-42845
  • GHSA-w4rc-p66m-x6qq

Timeline

  • 2026-04-29: disclosed: Vulnerability reported and patch committed
  • 2026-05-06: advisory: GitHub Advisory published
  • 2026-05-11: patched: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.