CVE-2026-61873 Details

An arbitrary file write vulnerability has been identified in the Grav Form plugin, affecting versions prior to 9.1.8. The issue arises in the 'process.save.filename' parameter, which is initially validated against path traversal before being processed by Twig templates. However, this validation is not reapplied after rendering, creating a time-of-check to time-of-use (TOCTOU) vulnerability. Attackers can exploit this by submitting form data with path traversal sequences, which are then processed through Twig, allowing them to write arbitrary files, including PHP webshells, to the web root or other sensitive directories.

Users are advised to update Grav to version 9.1.8 or later, where this vulnerability has been patched.