CVE-2026-61873

Name of the Vulnerable Software and Affected Versions Grav versions prior to 9.1.8

Description An arbitrary file write issue exists in the Form plugin. The process.save.filename parameter is validated against path traversal before Twig processing but is not re-validated after rendering. This allows attackers to submit form data with path traversal sequences that, when processed through Twig templates, enable the creation of arbitrary files, such as PHP webshells, within the web root or other sensitive directories.

Recommendations Update to version 9.1.8 or later.