CVE-2026-75107 getgrav CVE debrief

Who should care

Defenders who manage Grav Form Plugin installations should assess exposure and prioritize updating to version 9.1.19 or later. Additionally, defenders should monitor their systems for any suspicious activity and ensure that only authorized users have form authoring privileges.

Why it matters

The Grav Form Plugin vulnerability allows attackers to inject arbitrary HTML and JavaScript, affecting all form visitors. Defenders should prioritize updating to version 9.1.19 or later and monitor systems for suspicious activity.

• Attackers can inject arbitrary HTML and JavaScript into form templates
• All form visitors are affected by the injected code
• Defenders need to update to version 9.1.19 or later to mitigate the vulnerability
• Defenders should monitor systems for suspicious activity

Technical summary

The Grav Form Plugin before version 9.1.19 fails to escape field-definition properties, including prepend, append, spacer text, section text, and select option labels, in form templates. This allows attackers with form authoring privileges to inject arbitrary HTML and JavaScript that executes for all form visitors. The vulnerability affects all form visitors and defenders should prioritize updating to version 9.1.19 or later to mitigate this vulnerability. Additionally, defenders should monitor their systems for any suspicious activity and ensure that only authorized users have form authoring privileges.

Defensive priority

Defenders should prioritize updating the Grav Form Plugin to version 9.1.19 or later to mitigate this vulnerability. Additionally, defenders should monitor their systems for any suspicious activity and ensure that only authorized users have form authoring privileges.

Recommended defensive actions

• Update the Grav Form Plugin to version 9.1.19 or later
• Monitor systems for suspicious activity
• Ensure only authorized users have form authoring privileges
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond updating to version 9.1.19 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.