CVE-2026-69087 Details
Description
The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. When a form blueprint defines a redirect target such as redirect: "{{ form.value('next') }}" using an attacker-controllable field, an unauthenticated form submitter can supply a value like https://evil.com to cause a 302 redirect to an arbitrary external site, enabling phishing.
An open redirect vulnerability has been identified in the Grav Form Plugin (getgrav/grav-plugin-form) versions prior to 9.1.13. This vulnerability arises because, starting from version 9.1.11, the plugin's redirect process action began to evaluate user-supplied form data within Twig expressions. The Grav::redirect() function then accepted external URLs without validating their origin. As a result, when a form blueprint specifies a redirect target that includes user-controlled input, an unauthenticated form submitter can manipulate the input to redirect to an arbitrary external site, potentially leading to phishing attacks.
Users can update the Grav Form Plugin to version 9.1.13 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-j2j9-gp72-wqvm | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-j2j9-gp72-wqvm | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/grav-form-plugin-before-open-redirect-via-form-value-twig | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Form | >= 0, < 9.1.13 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |