CVE-2026-69087

This is a framework design failure, not a developer mistake. CVE-2026-69087 stems from Grav's redirect() function accepting arbitrary external URLs without origin validation, combined with the form plugin's ability to evaluate Twig expressions in redirect targets starting in version 9.1.11. When a developer uses `redirect: "{{ form.value('next') }}"` in a blueprint — a reasonable pattern for multi-step forms — they create an unauthenticated open redirect exploitable by anyone. The CVSS of 6.5 reflects this: no authentication required, direct phishing vector, trivial to exploit. Check your Grav version immediately. If you're on any version before 9.1.13, upgrade. Then audit your form blueprints for any dynamic redirect targets that pull from user-supplied data — form fields, query parameters, or session values being evaluated into redirect URLs are the exposure. Even if you "would never use that pattern," a previous developer might have, and the vulnerability exists regardless of intent. The deeper issue: Grav::redirect() should reject external URLs by default, requiring explicit opt-in for external targets. This shifts security from "developers must validate every redirect" to "developers must explicitly request dangerous behavior." That's the architectural fix that prevents this entire class of bug. The question for Grav maintainers is whether v9.1.13 implemented that architectural change or merely patched the specific Twig expression. For self-hosted Grav users: there's no infrastructure layer above your plugin/blueprint code enforcing redirect policies. You own the entire stack. This makes the architectural question more urgent — you cannot rely on gateway-layer redirect restrictions the way SaaS deployments can. Audit any plugin or theme that performs redirects, especially those using Twig-evaluated values in target URLs.

Reviewed through automated stages and approved by a human before publication.