Executive brief
The Grav Form plugin, used to handle user-submitted forms on Grav CMS websites, contains a vulnerability that allows unauthenticated visitors to overwrite website content. By uploading a specially crafted file, an attacker can replace existing page definitions with their own. This can be used to hijack site functionality or create new administrative accounts, leading to a full takeover of the website.
Technical details
The Form plugin's file upload handler in `Form.php` accepts a user-supplied `filename` parameter that overrides the original uploaded filename. While the plugin uses `Utils::checkFilename()` to block dangerous extensions like `.php`, it does not block Markdown (`.md`) or YAML files. When a form is configured to accept all file types (`accept: ['*']`) and uses the `self@` destination, an unauthenticated attacker can provide a `filename` that matches the page's own content file (e.g., `form.md`). The `moveTo()` function subsequently overwrites the existing page file with the attacker's content. Since Grav pages define logic and frontmatter in these files, an attacker can redefine the page to execute administrative actions, such as creating a new super-admin user. This is fixed in version 9.1.0.
Affected products
- getgrav grav-plugin-form < 9.1.0
Timeline
- 2026-04-29: disclosed: Vulnerability reported and patch committed
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-11: patched: NVD publication date