Exploited vulnerability

CVE-2026-42608

TLP:CLEAR

getgrav grav Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.

Facts

Vendor: getgrav
Product: grav
EPSS (probability of exploitation within 30 days): 0.6 %
First known exploitation: 25 September 2026
First seen by Risk Letters: 25 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD