Open Redirect Vulnerability in Grav Form Plugin by Grav

CVE-2026-69087

What is CVE-2026-69087?

The Grav Form Plugin, prior to version 9.1.13, is susceptible to an open redirect vulnerability. This arises from the plugin's handling of user-supplied form data within Twig expressions, coupled with the lack of origin validation in the Grav::redirect() function. An attacker can exploit this flaw by manipulating a field in a form blueprint, allowing them to include an external URL for redirection. For instance, if a blueprint specifies a redirect target that incorporates user input, an unauthorized individual submitting the form can redirect users to malicious sites, facilitating phishing attacks.

References