# CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP upload

Source: https://junglewise.ai/threats/cve-2026-42607-grav-remote-code-execution-via-direct-install-zip-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2026-42607 · Severity: critical · CVSS 9.1 · Published 2026-05-11

Grav, a popular open-source content management system, is vulnerable to a security flaw in its plugin installation tool. An attacker with administrative access can upload a malicious ZIP file that, when processed by the system, allows them to execute arbitrary commands on the server. This could lead to a complete takeover of the website, data theft, or a total service outage.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42607 being exploited in the wild.

**How severe is CVE-2026-42607?** Critical severity, with a CVSS score of 9.1, published 11 May 2026.

**Which products and versions are affected?** Grav < 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.

**Is there a fix for CVE-2026-42607?** Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42607 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42607?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later

  ```sh
  composer require getgrav/grav:^2.0.0-beta.2
  ```


## Technical details

A vulnerability in Grav's Admin plugin and Grav Package Manager (GPM) core allows for Remote Code Execution (RCE) and Path Traversal (Zip Slip). The 'directInstall' task fails to validate the contents of uploaded ZIP archives before extraction. An authenticated attacker with administrative privileges can upload a ZIP containing malicious PHP scripts or path traversal primitives (e.g., '../') to write files to arbitrary locations or execute code upon plugin initialization. The root cause is located in 'Installer::install()' and 'Gpm.php', where extraction occurs without extension or path validation. A partial fix in version 2.0.0-beta.2 introduces path validation to prevent Zip Slip, though administrators are still cautioned to only install plugins from trusted sources as the feature's intent is to execute PHP.

## Affected products

- getgrav Grav < 2.0.0-beta.2

## Identifiers

- CVE-2026-42607
- GHSA-w48r-jppp-rcfw

## Timeline

- 2026-04-24: patched: Partial fix applied in Grav core 2.0 branch
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: other: NVD published

## References

- [https://api.github.com/users/akgul7990](https://api.github.com/users/akgul7990)
- [https://github.com/akgul7990](https://github.com/akgul7990)
- [https://api.github.com/users/akgul7990/gists%7B/gist_id%7D](https://api.github.com/users/akgul7990/gists%7B/gist_id%7D)
- [https://api.github.com/users/akgul7990/repos](https://api.github.com/users/akgul7990/repos)
- [https://avatars.githubusercontent.com/u/57252649?v=4](https://avatars.githubusercontent.com/u/57252649?v=4)
- [https://api.github.com/users/akgul7990/events%7B/privacy%7D](https://api.github.com/users/akgul7990/events%7B/privacy%7D)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)