CVE-2026-42607

published 2026-05-11

CVE-2026-42607: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by…

Priority P2 68 critical 9.1 CVSS 3.1

AV N AC L PR H UI N S C C H I H A H

EXPLOIT

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
getgrav	grav	< 2.0.0-beta.2	2.0.0-beta.2
getgrav	grav	>= 0 < 2.0.0-beta.2	2.0.0-beta.2

Detection & IOCs extracted from sources · hover to see the quote

path /shell.php↗

filename shellplugin.zip↗

url /admin/tools/direct-install↗

command curl "http:///shell.php?cmd=id"↗

path GRAV_ROOT . '/shell.php'↗

• → Monitor for ZIP file uploads to the Grav Direct Install endpoint (/admin/tools/direct-install) that contain .php files within the archive — the platform blocks direct .php uploads but does not inspect ZIP contents. ↗
• → Alert on creation of shell.php at the web root (GRAV_ROOT) following a plugin installation event, as the malicious plugin drops a persistent web shell on first request after extraction. ↗
• → Detect HTTP GET requests to /shell.php with a 'cmd' query parameter, which is the access pattern used to interact with the dropped web shell. ↗
• → Look for ZIP archives uploaded to Grav that contain a plugin directory with PHP files using the onPluginsInitialized hook, which is the trigger mechanism for the malicious payload. ↗
• → Flag file_put_contents calls writing to GRAV_ROOT from within a plugin context, as this is the mechanism used to persist the web shell. ↗

• · Exploitation requires an authenticated session with administrative privileges; however, the advisory notes CSRF as a potential escalation path to trigger the upload without direct admin interaction. ↗
• · The fix is available in Grav 2.0.0-beta.2; instances running any version prior to this are vulnerable to the ZIP-based RCE via Direct Install. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94