LIVE FEED
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiperHardening a Personal Linux Server in an AfternoonMicrosoft 365 outage disrupts Outlook, Teams, and Copilot worldwideCheck Point patches zero-day root escalation flaw exploited against customersHackers Compromise 4,800 GitHub Accounts to Steal Cloud CredentialsHow to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an AfternoonBaker Tilly notifies clients of data breach at third-party provider
HIGH CWE-22

CVE-2026-42608

Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Getgrav·grav

8.8/ 10
CVSS 4.0
High severity
0.60%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 49% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list, but a public proof of concept exists.
Timeline
Published
May 11, 2026
Updated
May 11, 2026
First covered
Sep 26, 2026
Latest story
2 months ago

Summary

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Attack profile

Attack vectorNetwork
ComplexityLow
RequirementsNone
PrivilegesNone
User interactionNone
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Affected products

  • Getgrav grav< 2.0.0-beta.2

References

CVE.org recordcve.org NVD entrynvd.nist.gov X_refsource_CONFIRMgithub.com
Daily at 7:00 AM Eastern

The 0700 Brief

Every new security and AI story, summarised in one email. Confirm by email, unsubscribe in one click.

43 readers have subscribed