Insufficient Permission Validation

getgrav/grav is vulnerable to Insufficient Permission Validation. The vulnerability is due to enabling regular users with page creation privileges to access the Frontmatter feature when the data[_json][header][form] parameter is included in the POST body while creating a page. The vulnerability is also due to inadequate File Name Validation while submitting the Contact Form in the name field. This can lead to an attacker creating files on the server like phar files possibly leading to Remote Code Execution (RCE).