CVE-2026-61873

creationtimestamp| type| source ---|---|--- 2026-07-15 16:14:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp4jgjut22x...

CVE-2026-61873 Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...