CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP upload

CVE-2026-42607 · Severity: critical · CVSS 9.1 · Published 2026-05-11

Grav, a popular open-source content management system, is vulnerable to a security flaw in its plugin installation tool. An attacker with administrative access can upload a malicious ZIP file that, when processed by the system, allows them to execute arbitrary commands on the server. This could lead to a complete takeover of the website, data theft, or a total service outage.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42607 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42607 being exploited in the wild.
How severe is CVE-2026-42607?
Critical severity, with a CVSS score of 9.1, published 11 May 2026.
Which products and versions are affected?
Grav < 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.
Is there a fix for CVE-2026-42607?
Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42607 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42607?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later
    composer require getgrav/grav:^2.0.0-beta.2

Technical details

A vulnerability in Grav's Admin plugin and Grav Package Manager (GPM) core allows for Remote Code Execution (RCE) and Path Traversal (Zip Slip). The 'directInstall' task fails to validate the contents of uploaded ZIP archives before extraction. An authenticated attacker with administrative privileges can upload a ZIP containing malicious PHP scripts or path traversal primitives (e.g., '../') to write files to arbitrary locations or execute code upon plugin initialization. The root cause is located in 'Installer::install()' and 'Gpm.php', where extraction occurs without extension or path validation. A partial fix in version 2.0.0-beta.2 introduces path validation to prevent Zip Slip, though administrators are still cautioned to only install plugins from trusted sources as the feature's intent is to execute PHP.

Affected products

  • getgrav Grav < 2.0.0-beta.2

Identifiers

  • CVE-2026-42607
  • GHSA-w48r-jppp-rcfw

Timeline

  • 2026-04-24: patched: Partial fix applied in Grav core 2.0 branch
  • 2026-05-05: advisory: GitHub Advisory published
  • 2026-05-11: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.