CVE-2026-69087: Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig
The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. When a form blueprint defines a redirect target such as redirect: "{{ form.value('next') }}" using an attacker-controllable field, an unauthenticated form submitter can supply a value like https://evil.com to cause a 302 redirect to an arbitrary external site, enabling phishing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-formto a version that resolves this vulnerability.Fixed in 9.1.13 - Configuration
In form blueprints, do not set the redirect target using attacker-controlled input (e.g., avoid redirect: "{{ form.value('next') }}"); use a fixed internal route or a server-side validated redirect value instead.
Grav form plugin blueprint redirect target redirect = (avoid Twig expression using user-controlled fields such as "{{ form.value('next') }}")
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69087?
CVE-2026-69087 has a medium severity rating of 6.5.
What is the risk associated with CVE-2026-69087?
CVE-2026-69087 has a risk score of 37.
How do I fix CVE-2026-69087?
To fix CVE-2026-69087, update the Grav Form Plugin to version 9.1.13 or later.
What does CVE-2026-69087 impact?
CVE-2026-69087 impacts the Grav Form Plugin versions before 9.1.13.
What type of vulnerability is CVE-2026-69087?
CVE-2026-69087 is classified as an open redirect vulnerability.