# CVE-2026-42844: Grav privilege escalation via arbitrary file upload in blueprint-upload API

Source: https://junglewise.ai/threats/cve-2026-42844-grav-privilege-escalation-via-arbitrary-file-upload-in-blueprint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-42844 · Severity: high · CVSS 8.8 · Published 2026-05-12

Grav is a file-based content management system (CMS) used to build and manage websites. A security flaw in its API allows a user with limited permissions to upload a specially crafted file that creates a new administrative account. An attacker can use this new account to take full control of the website, including modifying content, changing configurations, and managing other users.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42844 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42844 being exploited in the wild.

**How severe is CVE-2026-42844?** High severity, with a CVSS score of 8.8, published 12 May 2026.

**Which products and versions are affected?** Grav < 2.0.0-beta.4, 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.4, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.4.

**Is there a fix for CVE-2026-42844?** Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42844 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42844?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.0-beta.4 or later

  ```sh
  composer require getgrav/grav:^2.0.0-beta.4
  ```


## Technical details

An authenticated vertical privilege escalation vulnerability exists in Grav 2.0.0-beta.2 due to improper path validation in the '/api/v1/blueprint-upload' endpoint. By manipulating the 'destination' and 'scope' parameters, an attacker with 'api.media.write' permissions can bypass intended directory restrictions to write arbitrary YAML files into the 'user/accounts/' directory. Since Grav uses these YAML files for user authentication and supports plaintext passwords for initial logins, an attacker can plant a new user file with 'api.super' privileges. This allows the attacker to log in as a super-administrator, resulting in full compromise of the Grav API and the underlying CMS. The issue is fixed in API version 1.0.0-beta.17.

## Affected products

- getgrav Grav 2.0.0-beta.2

## Identifiers

- CVE-2026-42844
- GHSA-6xx2-m8wv-756h

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published by vendor
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h](https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)