An arbitrary file write flaw exists in Grav CMS prior to version 9.1.8. The vulnerability lies in the Form plugin where the `process.save.filename` parameter is checked for path traversal before Twig templates are applied, but not re‑checked afterward. An attacker can submit a form containing a filename with Twig syntax that expands to a path traversal sequence, enabling the server to write an arbitrary file such as a PHP webshell into the web root or other writable directories. This can result in remote code execution, site defacement, or the compromise of other files.

The flaw affects installations of Grav CMS using the Form plugin version earlier than 9.1.8. The product is maintained by the Grav project (getgrav). Only releases prior to 9.1.8 are vulnerable; newer releases contain the patch.

The CVSS score of 7.2 marks it as high severity. The EPSS score is below 1 %, indicating low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, via a publicly accessible web form that the Form plugin processes. An attacker must be able to reach the Form endpoint and provide crafted filename data; no local privilege escalation is required.