CVE-2026-61873

Grav before 9.1.8 is affected by an arbitrary file write in the Form plugin via the process.save.filename parameter. The parameter is path-traversal validated before Twig processing but not re-validated after rendering, enabling an attacker to submit form data that writes arbitrary files (includi...

PT-2026-60162

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...