CVE-2026-61873: Grav Form plugin arbitrary file write via Twig-processed filename

CVE-2026-61873 · Severity: high · CVSS 8.1 · Published 2026-07-15

Grav, a popular content management system, contains a security flaw in its Form plugin which handles how user-submitted data is saved to files. An attacker can bypass security checks to write malicious files, such as web shells, directly onto the web server. This could allow an attacker to take full control of the website, modify its content, or disrupt operations.

Technologies: Grav Form Plugin, Grav. Vendors: Grav.

Quick answers

Is CVE-2026-61873 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61873 being exploited in the wild.
How severe is CVE-2026-61873?
High severity, with a CVSS score of 8.1, published 15 July 2026.
Which products and versions are affected?
Grav Form Plugin <= 9.1.7; Grav <= 9.1.7.
Is there a fix for CVE-2026-61873?
A patch was published on 2026-07-15: Fix released in version 9.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61873 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61873?
Check whether you run Grav Form Plugin or Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An arbitrary file write vulnerability exists in the Grav Form plugin's 'process.save.filename' parameter. The application performs path traversal and file extension validation on the raw Twig template string before it is rendered, but fails to re-validate the final filename after Twig processes user-supplied variables. By submitting form data containing path traversal sequences (e.g., '../../') and dangerous extensions (e.g., '.php'), an attacker with page editor privileges can escape the intended data directory. This allows for the creation of PHP webshells in the web root or the overwriting of sensitive plugin files. The issue is addressed in version 9.1.8 by re-validating the rendered filename.

Affected products

  • getgrav Grav Form Plugin <= 9.1.7
  • getgrav Grav < 9.1.8

Timeline

  • 2026-06-26: advisory: GitHub Security Advisory published by vendor
  • 2026-07-15: disclosed: NVD publication date
  • 2026-07-15: patched: Fix released in version 9.1.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.