CVE-2026-61873

Grav before 9.1.8 is affected by an arbitrary file write in the Form plugin via the process.save.filename parameter. The parameter is path-traversal validated before Twig processing but not re-validated after rendering, enabling an attacker to submit form data that writes arbitrary files (includi...