Loading vulnerability…
Unauthenticated Path Traversal in Grav CMS FormFlash
CVE-2026-42608 is an unauthenticated path traversal vulnerability in the FormFlash component of Grav CMS core. Insufficient validation of form-related identifiers before their use in filesystem paths allows remote attackers to escape the intended temporary storage directory. Manipulating the session_id value supplied through the __form-flash-id POST parameter permits directory creation and writing attacker-controlled YAML metadata outside the intended location. Exploitation details also identify unique_form_id as a traversal input in core form-upload handling. The vulnerability can alter application behavior, compromise data integrity, and disrupt service. Fixes are available in Grav 2.0.0-beta.2 and in the legacy 1.7 branch starting with 1.7.53.4. Exposure depends on Grav core rather than the Form plugin version.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized filesystem modifications within the Grav process's write permissions, including directory creation and attacker-controlled metadata writes outside intended temporary storage. These modifications can change application behavior, enable website defacement, damage data integrity, and disrupt service. Exploitation was confirmed in the compromise of Clop's leak site. Associated claims of source-code, log, and private-key theft were disputed and do not establish an arbitrary-read or code-execution primitive from this vulnerability alone.
If you can’t patch tonight, do this now.
No vendor-supported workaround is identified. Pending upgrade, restrict access to vulnerable form-processing endpoints or temporarily disable the affected functionality. Apply least-privilege filesystem permissions to limit where the Grav process can create directories and write files. These measures reduce exposure or impact but do not replace the core update.
Patch, then assume compromise.
Upgrade Grav 1.7 installations to version 1.7.53.4 or a later fixed release. For Grav 2.x, use version 2.0.0-beta.2 or later. Updating only the Form plugin does not remediate the vulnerable core code. The fix introduces sanitizeId() validation that restricts identifiers to the allowlist pattern [A-Za-z0-9,_-]{1,64}, preventing traversal characters from being used as filesystem path components.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.