CVE-2026-69087

Name of the Vulnerable Software and Affected Versions Grav form plugin versions prior to 9.1.13

Description An open redirect issue exists where the redirect process action evaluates user-supplied form data within Twig expressions. Because the Grav::redirect() function accepts external URLs without validating the origin, an unauthenticated user can submit a malicious value through an attacker-controllable field. This occurs when a form blueprint defines a redirect target using the form.value() function, such as redirect: "{{ form.value('next') }}", allowing the attacker to trigger a 302 redirect to an arbitrary external site for phishing purposes.

Recommendations Update to version 9.1.13 or later.