Grav Plugin Form
Approved changes feed: RSS · Atom
cpe:2.3:a:getgrav:grav-plugin-form:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Getgrav (a335dd59-994b-520f-884a-04ce57f966e0) |
|---|---|
| Product | Grav Plugin Form (aba4b702-e07b-5f59-989c-737cf6d227e2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42845 |
vulnerable | 2026-06-08 08:03:16.815149 |
Grav: Anonymous Page Content Overwrite via Form File Upload filename Override
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.
Published: 2026-05-11T15:44:35.524Z
Updated: 2026-05-12T13:49:49.704Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42842 |
vulnerable | 2026-06-08 08:03:16.811862 |
grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
MEDIUM (5.4)
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.
Published: 2026-05-11T15:29:36.490Z
Updated: 2026-05-11T18:25:09.488Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.