Technical impact
The Grav form plugin (getgrav/grav-plugin-form) processes redirect instructions inside Twig expressions that can originate from user‑supplied form data. This creates a CWE‑601 Open Redirect weakness because the Grav::redirect() function accepts external URLs without validating the origin. By defining a redirect target such as redirect: "{{ form.value('next') }}" in the form blueprint, an attacker can provide an arbitrary URL like https://evil.com in the 'next' field and trigger a 302 redirect to that site. The outcome is that unauthenticated users are sent to malicious destinations, facilitating phishing or social‑engineering attacks.
Affected Systems
All deployments of the Grav form plugin before version 9.1.13 are vulnerable. The issue is specific to the form component of the Grav CMS (Getgrav: Grav plugin form). Exact affected releases include any release earlier than 9.1.13, and no version information is available for later releases beyond that point.
Risk and Exploitability
The CVSS scoring of 7.1 places the vulnerability in the high severity range, indicating a significant risk to users following a redirect. The EPSS score of <1% suggests that, at the time of this reporting, the likelihood of widespread exploitation is low, but the potential impact remains serious because the redirect can be triggered by a simple form submission without authentication. The vulnerability is not listed in the CISA KEV catalog, which may reflect its limited current exploitation but does not reduce the need for a timely response. An attacker only needs to craft a malicious form submission containing a controlled 'next' value to abuse the redirect.
