The vulnerability permits an unauthenticated attacker to overwrite the content of any page by uploading a file whose name is later used to replace the page’s markdown (or other supported page‑content) file. It is a classic path‑traversal and file‑overwrite flaw classified as CWE‑73. An attacker who can cause the form plugin to process a "process: save" action could alter a page to insert malicious content or to pivot to a super‑admin role. The impact is high confidentiality and integrity loss for the entire content repository, and potentially availability if critical pages are corrupted.

This issue affects the Grav CMS form plugin (getgrav:grav-plugin-form) on all deployments running versions older than 9.1.0. The fix is included in 9.1.0 and later releases.

The CVSS score of 7.7 indicates a high risk class vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit it via a public form upload, requiring no authentication and minimal configuration—only a permissive accept policy and a default destination of "self@". If such a configuration exists, the vulnerability can be triggered simply by posting a file with an overridable name. Due to these conditions the fault has a high likelihood of exploitation in the wild if the vulnerable plugin is installed.