Get real-time updates on Telegram
CVE-2026-61873: grav 0 to before 9.1.8
CVE-2026-61873. CVSS 3.1 base score 8.1 (HIGH, Vendor/CNA). EPSS 0.0046 (percentile 0.38925), scored 24-Oct-2026.
Affected technology
grav · 0 to before 9.1.8
getgrav
Description’s affected range: before 9.1.8
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to write arbitrary files including PHP webshells to the web root or other sensitive directories. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality impact as none; integrity and availability impact as high.
- CWE
- CWE-73
- CCR priority
- 32.5 /100 (P4)
- CVSS 3.1
- 8.1 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · Vendor/CNA
- EPSS
- 0.0046 · percentile 0.38925 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-61873.html