Vulnerability Description
Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to write arbitrary files including PHP webshells to the web root or other sensitive directories.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav/security/advisories/GHSA-q532-mvx7-42qg
- https://www.vulncheck.com/advisories/grav-before-arbitrary-file-write-via-twig-p
- https://github.com/getgrav/grav/security/advisories/GHSA-q532-mvx7-42qg
FAQ
What is CVE-2026-61873?
CVE-2026-61873 is a vulnerability with a CVSS score of 8.1 (HIGH). Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-val...
How severe is CVE-2026-61873?
CVE-2026-61873 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61873?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.