CVE-2026-42607
published 2026-05-11CVE-2026-42607: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by…
PriorityP267critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EXPLOIT
EPSS
2.25%
82.8th percentile
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 2.0.0-beta.2 | 2.0.0-beta.2 |
| getgrav | grav | >= 0 < 2.0.0-beta.2 | 2.0.0-beta.2 |
| getgrav | grav | >= 1.0.0 < 2.0.0 | 2.0.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for ZIP file uploads to the Grav Direct Install endpoint (/admin/tools/direct-install) that contain .php files within the archive — the platform blocks direct .php uploads but does not inspect ZIP contents. ↗
- →Alert on creation of shell.php at the web root (GRAV_ROOT) following a plugin installation event, as the malicious plugin drops a persistent web shell on first request after extraction. ↗
- →Detect HTTP GET requests to /shell.php with a 'cmd' query parameter, which is the access pattern used to interact with the dropped web shell. ↗
- →Look for ZIP archives uploaded to Grav that contain a plugin directory with PHP files using the onPluginsInitialized hook, which is the trigger mechanism for the malicious payload. ↗
- →Flag file_put_contents calls writing to GRAV_ROOT from within a plugin context, as this is the mechanism used to persist the web shell. ↗
- ·Exploitation requires an authenticated session with administrative privileges; however, the advisory notes CSRF as a potential escalation path to trigger the upload without direct admin interaction. ↗
- ·The fix is available in Grav 2.0.0-beta.2; instances running any version prior to this are vulnerable to the ZIP-based RCE via Direct Install. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
ghsa9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
ghsa·2026-09-16·CVSS 9.1
CVE-2026-59193 [CRITICAL] CWE-409 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
### Summary
An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method `Installer::unZip()` calls `ZipArchive::extractTo()` without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bomb (CWE-409), stack overflow (CWE-674), and disk/inode exhaustion.
### Details
The vulnerability is in `system/src/Grav/Common/GPM/Installer.php:176-208` (`Installer::unZip()`). The `ZipArchive::extractTo()` call at line 184 is not preceded by any validation of the archive contents.
Missing validation:
- ❌ No total uncompressed size check (decompression bomb — CWE-409)
- ❌ No entry count check (inode exhaustio
GHSA
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
ghsa·2026-05-05
CVE-2026-42607 [CRITICAL] CWE-94 Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
### Summary
An authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server.
### Details
The vulnerability exists in the handling of the directInstall task within the Admin plugin and the Grav Package Manager (GPM) core.
- Vulnerable Endpoints: /admin/tools/direct-install
- Vulnerable Logic: AdminController.php (lines 1247-1295) and Gpm.php (line
No detection rules found.
No writeups or analysis indexed.
2026-05-11
Published