CVE-2026-42608: Grav Path Traversal and Arbitrary File Write in FormFlash

CVE-2026-42608 · Severity: critical · CVSS 9.1 · Published 2026-05-11

Grav, a popular file-based content management system, contains a security flaw in how it handles temporary form data. An unauthenticated attacker can exploit this to create unauthorized folders and files on the web server. This could allow an attacker to disrupt website operations, corrupt site data, or potentially change the website's configuration.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42608 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42608 being exploited in the wild.
How severe is CVE-2026-42608?
Critical severity, with a CVSS score of 9.1, published 11 May 2026.
Which products and versions are affected?
Grav < 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2; Trilby Media Grav CMS < 2.0.0-beta.2.
Is there a fix for CVE-2026-42608?
Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42608 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42608?
Check whether you run Grav, getgrav/grav (Packagist) or Trilby Media Grav CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later
    composer require getgrav/grav:^2.0.0-beta.2

Technical details

A path traversal vulnerability exists in the FormFlash core component of Grav CMS due to insufficient sanitization of the session_id parameter. The FormFlash::__construct() and getTmpDir() methods use the raw session identifier (passed via the __form-flash-id POST parameter) to construct filesystem paths for temporary form storage. An unauthenticated remote attacker can use '../' sequences to escape the intended temporary directory and create arbitrary subdirectories and 'index.yaml' files in any location writable by the web server process, such as configuration or cache folders. This can lead to configuration injection or denial of service. The issue is resolved in version 2.0.0-beta.2 by implementing a strict alphanumeric allowlist for session identifiers.

Affected products

  • getgrav Grav < 2.0.0-beta.2

Identifiers

  • CVE-2026-42608
  • GHSA-hmcx-ch82-3fv2

Timeline

  • 2026-04-24: patched: Fix applied to the 2.0 branch
  • 2026-04-27: advisory: GitHub Security Advisory published
  • 2026-05-11: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.