Vulnerability Description
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav-plugin-form/commit/48bacc4187e1cff815000e526d5ca
- https://github.com/getgrav/grav/security/advisories/GHSA-w4rc-p66m-x6qq
- https://github.com/getgrav/grav/security/advisories/GHSA-w4rc-p66m-x6qq
FAQ
What is CVE-2026-42845?
CVE-2026-42845 is a documented vulnerability. The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now st...
How severe is CVE-2026-42845?
CVSS scoring is not yet available for CVE-2026-42845. Check NVD for updates.
Is there a patch for CVE-2026-42845?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.