CVE-2026-42608
Description
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.
How to fix
- getgrav grav2.0.0 or later
- getgrav/grav2.0.0-beta.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getgrav grav | v < 2.0.0, 2.0.0 | 2.0.0 |
| getgrav/gravPackagist | v < 2.0.0-beta.2 | 2.0.0-beta.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.