CVE-2026-42845
CVE-2026-42845 · Grav: Anonymous Page Content Overwrite via Form File Upload filename Override
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.
CVSS 7.7 · Élevée · EPSS 0,7% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
grav-plugin-form
- Versions du logiciel
- < 9.1.0: Concernée
Aucun correctif publié
getgrav/grav-plugin-form Packagist
- Plages de versions concernées
- ECOSYSTEM: < 9.1.0
Mettez à jour vers 9.1.0