A high-profile data leak site breach highlights a critical vulnerability in a popular content management system (CMS). The Clop ransomware gang’s leak site was hacked by ShinyHunters, an extortion gang that claims to have stolen source code, plugins, server logs, and private keys from the compromised server. This brazen attack raises concerns about the security of sites using Grav CMS, a widely-used platform for building websites.
The breach occurred when ShinyHunters exploited an unpatched path traversal vulnerability in Grav CMS 1.7.43. According to the threat actor, the flaw allowed them to create temporary upload directories outside the intended directory, enabling them to write files anywhere on the server. The vulnerability was caused by Grav’s failure to validate form-related POST parameters as safe filesystem path components, allowing attackers to manipulate directory paths.
Grav CMS developers have since confirmed that ShinyHunters’ description of the flaw is accurate and have assigned a CVE-2026-42608 identifier to it. Although the fix for this vulnerability was privately reported and included in Grav 2.x releases earlier this year, it had not been backported to older versions like 1.7.43, leaving sites like Clop’s vulnerable.
The exploitation details shared by ShinyHunters revealed that they used a specific technique to manipulate directory paths, adding directory traversal sequences to the unique form identifier. This allowed them to create an upload path outside the intended tmp/forms directory, effectively bypassing Grav’s security checks. The fix for this vulnerability added sanitization to the unique identifier, restricting it to alphanumeric characters and underscores.
The Clop ransomware gang has denied any relationship or negotiations with ShinyHunters, claiming that their server contained no sensitive data or financial activity. However, the group did acknowledge that its Grav installation was not fully updated, leaving it vulnerable to this exploit.
This incident serves as a stark reminder of the importance of staying up-to-date with security patches and updates for critical systems like CMS platforms. Website administrators using Grav CMS should take immediate action to update their installations to version 2.x or apply the backported fix to their 1.7.x versions. Regularly monitoring system logs and implementing robust security measures can also help prevent such breaches in the future.
In conclusion, this breach highlights the risks associated with outdated software and underscores the need for continuous vigilance in maintaining the security of online platforms. As a precautionary measure, administrators should ensure that their CMS installations are secure and take steps to protect against similar attacks.
Source: Bleeping Computer — 2026-09-25