"Yes, it's a legitimate flaw, and the threat actor's description is accurate," Grav told BleepingComputer about the vulnerability that let the ShinyHunters group breach the Clop gang's leak site.
CVE-2026-42608: a Grav core path traversal vulnerability
Grav has confirmed the weakness exploited in the intrusion carries the identifier CVE-2026-42608 and is a path traversal flaw in Grav core. According to the developers, the issue was privately reported and fixed in the Grav 2.0 line (2.0.0-beta.2), with an advisory published on April 27. The mitigation — a sanitizeId() function that only accepts identifiers matching the allowlist "[A-Za-z0-9,_-]{{1,64}}" — was added in 2.x and, after details were shared by BleepingComputer, backported to the older 1.7 branch in release 1.7.53.4.
How ShinyHunters says it exploited __unique_form_id__
ShinyHunters told BleepingComputer the compromised Clop server ran Grav CMS 1.7.43 and that the group exploited an unauthenticated file upload flaw in Grav's form upload handling. The threat actor described how Grav used values supplied through form-related POST parameters when creating temporary upload directories without validating them as safe filesystem path components. Specifically, ShinyHunters identified the __unique_form_id__ parameter and said the value was incorporated into a temporary path such as:
tmp/forms/<session_id>/<unique_id>
By supplying directory traversal sequences (the group gave "../../../shhq" as an example) for the unique form identifier, ShinyHunters claims it could cause Grav to create an upload path outside the intended tmp/forms directory, allowing files to be written elsewhere under the Grav installation.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleShinyHunters' breach, the defacement, and claims about stolen materials
Earlier this month, ShinyHunters breached Clop's public leak site, first uploading a small text file and later replacing the site with a full-page defacement that displayed ShinyHunters' Umbreon Pokémon logo and a link to its own data leak site. On that site, ShinyHunters asserted it had stolen source code, Grav CMS plugins, server logs, and the private keys used by Clop's Tor onion service, and issued a ransom demand threatening to leak those files if Clop did not pay.
After the compromise became public, Clop was quietly removed from ShinyHunters' data leak site — a removal pattern the source notes "commonly happens when negotiations are taking place." When asked by BleepingComputer about the removal, ShinyHunters declined to answer further questions.
Clop's position and operational claims
Clop confirmed to BleepingComputer that its Grav installation "had not been fully updated," acknowledging the patch gap on the 1.7 line. Yet the ransomware gang disputed ShinyHunters' description of what was taken. "We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so—either now or in the future," Clop told BleepingComputer.
Clop also asserted the compromised server "contained nothing but content (meaning there was absolutely no data or financial activity there, nor could there have been). Therefore, their claim is worthless—as are their words." The gang announced a new Tor onion address for its leak site and said the old domain would remain accessible temporarily before being retired.
Grav's remediation: backport to 1.7 and guidance
Grav clarified the vulnerability "lives in Grav core, not the Form plugin," meaning the Form plugin version does not determine whether a site is vulnerable; the core version does. After BleepingComputer shared exploitation details, Grav backported the fix to the 1.7 branch and published Grav 1.7.53.4. Grav is urging anyone still running the 1.7 branch to upgrade to 1.7.53.4; the company noted current Grav 2.x releases had already been protected for months.
What this means for technologists and security teams, enterprises, and threat actors
- Technologists and security teams: Sites running Grav 1.7 should treat the core version as the decisive factor for exposure and deploy Grav 1.7.53.4 or migrate to the protected 2.x line. The exploit description emphasizes validation of form-supplied identifiers and the risk of unauthenticated upload paths.
- Affected enterprises and procurement leaders: If a public-facing service uses Grav 1.7, prioritize inventory and patching; the incident shows that even a content-only server can be used by other actors to make public claims or leverage operational artifacts.
- Adversaries and affiliated groups: The episode illustrates how one threat actor's breach can become leverage over another: ShinyHunters used a site compromise to extort Clop, and ShinyHunters' public claims and the later quiet removal of Clop from their site suggest dynamics of negotiation, reputation, and leverage among criminal actors.
The facts in this episode are narrow and direct: a core path traversal flaw (CVE-2026-42608) left older Grav 1.7 installs vulnerable, ShinyHunters says it exploited that gap to breach Clop's leak site and seize files, Grav has backported a fix in 1.7.53.4, and Clop denies operational loss while moving to a new onion address. For any organization running Grav 1.7, the immediate next step is the one Grav recommends — upgrade to 1.7.53.4 or to a protected 2.x release.
Source: BleepingComputer — ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
