CVE-2026-42845

Grav: Anonymous Page Content Overwrite via Form File Upload filename Override

Published: May 11, 2026Updated: May 12, 2026 Sources: CVE List NVDCWE-73

N/ACVSS

NVD MITRE

Description

The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.

No summary for this CVE yet.

Weaknesses

CWE-73

Affected Products

getgrav

oss-projectaka grav-plugin-admin, grav, getgrav/grav

grav-plugin-formOn-premCMS Plugin

Web & CMS Plugins / cms-core

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

References

https://github.com/getgrav/grav-plugin-form/commit/48bacc4187e1cff815000e526d5ca2878484867f

github.com

https://github.com/getgrav/grav/security/advisories/GHSA-w4rc-p66m-x6qq

github.com

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-42845 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows