CVE-2026-69087 Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig
An attacker can craft a form submission to redirect users to malicious external sites, facilitating phishing attacks against Grav CMS users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-69087?
CVE-2026-69087 is a high-severity vulnerability in getgrav grav-plugin-form, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. When a form blueprint defines a redirect target such as redirect: "{{ form.value('next') }}" using an attacker-controllable field, an unauthenticated form submitter can supply a value like https://evil.com to cause a 302 redirect to an arbitrary external site, enabling phishing.
Weakness: CWE-601
Which versions are affected by CVE-2026-69087?
How do I fix CVE-2026-69087?
No fix has been published for CVE-2026-69087 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-69087 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69087 exists.
Sources
Also known as GHSA-85vc-29fc-65gw.