CVE-2026-119529: Gravity Forms < 3.2.2 - Unauthenticated LFI via Chunked File Upload
The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravity Formsto a version that resolves this vulnerability.Fixed in 3.2.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Rocketgenius Gravity Forms versions before 3.2.2 are affected when the chunked file upload feature is reachable by unauthenticated users and the server is configured to parse Server-Side Include documents. Apache installations with SSI enabled are an example of the affected server configuration.
What does an attacker need to exploit it?
The attacker does not need to authenticate. They need access to the plugin's chunked file upload functionality and a server environment that parses SSI documents.
What can an attacker access if exploitation succeeds?
An attacker may be able to read server environment variables and files located within the web root.
What should be prioritized if an upgrade cannot be performed immediately?
Reduce or disable unauthenticated access to the chunked file upload feature and disable SSI document parsing where possible. These measures address the unauthenticated upload path and the server behavior required for the described file disclosure.