Executive brief
Grav, a popular content management system, contains a security flaw in its Form plugin which handles how user-submitted data is saved to files. An attacker can bypass security checks to write malicious files, such as web shells, directly onto the web server. This could allow an attacker to take full control of the website, modify its content, or disrupt operations.
Technical details
An arbitrary file write vulnerability exists in the Grav Form plugin's 'process.save.filename' parameter. The application performs path traversal and file extension validation on the raw Twig template string before it is rendered, but fails to re-validate the final filename after Twig processes user-supplied variables. By submitting form data containing path traversal sequences (e.g., '../../') and dangerous extensions (e.g., '.php'), an attacker with page editor privileges can escape the intended data directory. This allows for the creation of PHP webshells in the web root or the overwriting of sensitive plugin files. The issue is addressed in version 9.1.8 by re-validating the rendered filename.
Affected products
- getgrav Grav Form Plugin <= 9.1.7
- getgrav Grav < 9.1.8
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published by vendor
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Fix released in version 9.1.8