CVE-2026-69087: Grav Form Plugin Open Redirect Vulnerability

CVE-2026-69087 Overview

CVE-2026-69087 is an open redirect vulnerability in the Grav form plugin (getgrav/grav-plugin-form) affecting versions before 9.1.13. Starting in version 9.1.11, the plugin's redirect process action evaluates user-supplied form data inside Twig expressions. The Grav::redirect() function accepts external URLs without validating the origin. An unauthenticated attacker can submit a form value such as https://evil.com and force a 302 redirect to any external site. The flaw maps to CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Unauthenticated attackers can weaponize legitimate Grav sites to redirect visitors to phishing pages, laundering trust from the original domain.

Affected Products

Grav form plugin (getgrav/grav-plugin-form) 9.1.11
Grav form plugin (getgrav/grav-plugin-form) 9.1.12
All versions before 9.1.13

Discovery Timeline

2026-08-03 - CVE-2026-69087 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69087

Vulnerability Analysis

The Grav form plugin allows site authors to declare form process actions in blueprint YAML files. One such action, redirect, sends the client to a target URL after form submission. Beginning in version 9.1.11, the plugin passes the redirect target through Twig template evaluation before dispatching it. This lets blueprint authors write dynamic redirects such as redirect: "{{ form.value('next') }}".

The issue is that form.value('next') resolves to attacker-controllable submitted data. Grav::redirect() then issues a 302 response with that value in the Location header without checking whether the URL points to the same origin. An unauthenticated attacker who can submit the form controls the destination.

Because the redirect originates from a trusted Grav-hosted domain, targets are more likely to trust the resulting phishing page. The vulnerability requires user interaction (a victim clicking the crafted link) but no authentication.

Root Cause

The root cause is a combination of two design decisions. First, the plugin evaluates untrusted form input inside Twig expressions used to compute a redirect target. Second, Grav::redirect() does not enforce same-origin or allow-list validation on the resulting URL. Neither layer sanitizes or restricts the scheme and host of the destination.

Attack Vector

An attacker crafts a URL that submits a chosen next parameter to a vulnerable Grav form endpoint, for example by embedding form fields in a GET or POST request. The victim clicks the link, the server processes the submission, and Grav responds with a 302 redirect to the attacker's domain. The attack surface is network-reachable and unauthenticated, making it suitable for large-scale phishing campaigns hosted behind the reputation of the victim site.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-j2j9-gp72-wqvm and the Vulncheck Advisory for additional technical detail.

Detection Methods for CVE-2026-69087

Indicators of Compromise

HTTP 302 responses from Grav-hosted endpoints where the Location header points to an external domain not owned by the site operator.
Form submissions that include URL-shaped values (http://, https://, //, javascript:) in fields referenced by a blueprint redirect action.
Access logs showing repeated POST requests to form endpoints followed by outbound clicks from users landing on unfamiliar domains.

Detection Strategies

Audit all form blueprints under user/ and plugins/ for redirect: values that reference form.value(...), form.data, or other request-derived variables inside Twig delimiters.
Parse web server logs for 302 responses originating from Grav form handler paths and flag those with cross-origin Location headers.
Deploy WAF rules that inspect form fields consumed by redirect actions for URL schemes and reject values matching ^(https?:|//).

Monitoring Recommendations

Continuously monitor the installed version of getgrav/grav-plugin-form and alert on any deployment below 9.1.13.
Correlate outbound referrer traffic patterns to identify phishing campaigns abusing the site as a redirector.
Track abuse reports and threat intelligence feeds for the site domain appearing in URL-defanged phishing indicators.

How to Mitigate CVE-2026-69087

Immediate Actions Required

Upgrade the Grav form plugin to version 9.1.13 or later on all affected sites.
Inventory form blueprints and temporarily remove or hardcode any redirect targets that reference user-submitted values until the upgrade is applied.
Review recent access logs for suspicious 302 responses that may indicate active abuse.

Patch Information

The maintainers fixed the issue in getgrav/grav-plugin-form version 9.1.13. Details are published in the GitHub Security Advisory GHSA-j2j9-gp72-wqvm. Site operators should update through the Grav admin panel, the bin/gpm command, or by pulling the released version from the plugin repository.

Workarounds

If upgrading is not immediately possible, edit affected blueprints and replace dynamic redirect targets with static, server-controlled paths such as redirect: "/thank-you".
Apply an allow-list at the reverse proxy or WAF that rejects Location headers pointing to domains outside the site's own origin.
Disable or remove form definitions that expose a user-controlled next or similar redirect parameter until the plugin is patched.

bash

# Update the Grav form plugin using the Grav Package Manager
bin/gpm update form

# Verify the installed version is 9.1.13 or later
bin/gpm info form | grep -i version