ShinyHunters breached Clop's leak site via a Grav CMS path traversal flaw

The Clop ransomware gang has moved its data leak site to a fresh Tor address after confirming that its previous server had been compromised and defaced. The break-in exploited a flaw in the Grav CMS content management system that had never been patched. As BleepingComputer learned, it is an unauthenticated path traversal vulnerability.

The intruder was a rival extortion crew, ShinyHunters. The attackers first dropped a small text file onto the site, then replaced the whole page with a defacement showing their Umbreon Pokémon logo and a link to their own leak site. ShinyHunters later claimed to have stolen source code, Grav plugins, server logs, and the private keys for Clop's Tor onion service, following up with a ransom demand under threat of publishing the loot.

Denials and a dispute over the haul

Clop announced the new onion address, saying the old domain would stay online briefly before being retired. The gang denies any relationship or negotiations with ShinyHunters: "We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so—either now or in the future."

Clop did concede its Grav install had not been fully updated, but it disputes the value of what was taken, insisting the server "contained nothing but content"—no data, no financial activity—so ShinyHunters' claims are "worthless." Curiously, Clop was soon quietly removed from ShinyHunters' victim list, something that commonly happens when negotiations are under way. Asked about it, ShinyHunters declined to say more.

Grav confirms the flaw

The compromised server ran Grav CMS 1.7.43. Per ShinyHunters, the bug lived in Grav's form upload handling: values from POST parameters were used to build temporary upload directories without being validated as safe path components. By feeding directory traversal sequences such as ../../../shhq into the __unique_form_id__ parameter, an attacker could make Grav create a path outside tmp/forms and write the uploaded file elsewhere in the installation.

Given the details, Grav's developers confirmed the description was accurate. The flaw is tracked as CVE-2026-42608; it was privately reported and fixed in Grav 2.0 (2.0.0-beta.2) earlier this year, with the advisory published on April 27. The fix added a sanitizeId() function that only accepts identifiers matching the allowlist [A-Za-z0-9,_-]{1,64}.

The catch: the patch was never backported to the older 1.7 branch, leaving deployments like Clop's exposed. After BleepingComputer shared the exploitation details, Grav backported the fix and released Grav 1.7.53.4. The bug sits in Grav core, not the Form plugin, so the plugin version is irrelevant. Anyone still on the 1.7 branch is urged to upgrade.

Source: Bleeping Computer