CVE-2026-42608: Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-11 · updated 2026-10-26
Weakness: CWE-22

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.

Affected products

getgrav grav: before 2.0.0; 2.0.0-beta1 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: getgrav grav 2.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42608 or the next vulnerability affects your stack