CVE-2026-42608 Details
Description
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.
A path traversal vulnerability has been identified in Grav CMS versions prior to 2.0.0-beta.2, within the FormFlash core component. This vulnerability allows an unauthenticated attacker to manipulate the session_id parameter, passed as __form-flash-id in POST requests, to traverse the filesystem. Exploitation of this vulnerability enables the creation of arbitrary directories and the writing of an index.yaml file containing attacker-controlled data. The issue can disrupt application behavior, compromise data integrity, and cause service interruptions in production environments.
Users can update Grav to version 2.0.0-beta.2, where this vulnerability has been fixed. The update sanitizes the session_id before constructing paths, preventing the traversal. Additionally, ensure that sensitive directories have restrictive permissions to block unauthorized write access.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getgrav grav | < 2.0.0 2.0.0 beta1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |