The Clop ransomware operation has relocated its data leak site to a new Tor address after confirming its previous server was compromised through an unpatched flaw in Grav CMS. The extortion group ShinyHunters exploited the bug earlier this month, first posting a small text file on the site before replacing it entirely with a defacement featuring its Umbreon Pokémon branding and a link to its own leak site.
ShinyHunters later claimed on its own site that it had exfiltrated source code, Grav CMS plugins, server logs, and the private keys tied to Clop’s Tor onion service, then demanded a ransom from Clop under threat of leaking the stolen material.
Clop confirmed to BleepingComputer that its Grav installation had not been fully updated, but disputed the value of what was taken. “We didn’t update the Grav plugin, though it happened eventually, but the server contained nothing but content, meaning there was absolutely no data or financial activity there, nor could there have been,” the group said, calling ShinyHunters’ claims worthless. Clop also denied any relationship or contact with ShinyHunters, despite having since been quietly removed from ShinyHunters’ leak site, a pattern often associated with active negotiations. ShinyHunters declined to answer further questions about the removal.
Technical details confirmed by Grav
ShinyHunters told BleepingComputer that the compromised server ran Grav CMS 1.7.43 and that it exploited an unauthenticated file upload flaw in Grav’s form handling. The group said the vulnerable code used the __unique_form_id__ POST parameter to build a temporary upload path without validating it as a safe filesystem component, in the pattern tmp/forms/<session_id>/<unique_id>. By supplying traversal sequences such as ../../../shhq, an attacker could force Grav to write uploaded files outside the intended directory.
Grav confirmed the technical description was accurate. The flaw is tracked as CVE-2026-42608, a path traversal vulnerability that was privately reported and fixed in Grav 2.0 (2.0.0-beta.2), with an advisory published April 27. The fix introduced a sanitizeId() function restricting identifiers to the pattern [A-Za-z0-9,_-]{1,64}.
Grav clarified that the bug lives in Grav core rather than the Form plugin, so the Form plugin version does not determine exposure, only the core version does. The fix had not been backported to the legacy 1.7 branch, leaving deployments like Clop’s vulnerable. After BleepingComputer shared exploitation details, Grav backported the patch and released version 1.7.53.4. Sites on Grav 2.x have been protected since the original fix; Grav is urging remaining 1.7 users to upgrade immediately.