Skip to navigation

Threat reportVulnerabilityTL-2026-2671

ShinyHunters Exploit Grav CMS Path Traversal (CVE-2026-42608) to Hack Clop Ransomware Gang's Leak Site

criticalACTIVE

The ShinyHunters extortion group exploited an unauthenticated path traversal flaw (CVE-2026-42608) in Grav CMS's FormFlash form-upload component to breach and deface the Clop ransomware gang's Tor data leak site, claiming to have stolen source code, Grav plugins, server logs, and the private keys for Clop's onion service.

Key facts

IdentifiersTL-2026-2671, CVE-2026-42608, CVE-2025-61882
Also known asClop Leak Site Hijack
SeverityCRITICAL
CVSS9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2025-61882 (added )
EPSSCVE-2025-61882: 99.7% (99.9th percentile); CVE-2026-42608: 0.5% (41.9th percentile)
Affected productsGrav (Trilby Media LLC / getgrav) Grav CMS
Weaknesses (CWE)CWE-22
AttributionShinyHunters (high confidence)
MalwareClop, scattered lapsus$ hunters
ToolsUmbreon
MITRE ATT&CK techniquesT1005 Data from Local System, T1190 Exploit Public-Facing Application, T1491.002 External Defacement, T1552.004 Private Keys, T1584.004 Server, T1592.002 Software, T1594 Search Victim-Owned Websites, T1595.002 Vulnerability Scanning, T1657 Financial Theft
MotivationFINANCIAL
Target sectorscybercriminal-infrastructure
Target regionsGlobal
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2671 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Grav CMS FormFlash Path Traversal Exploitation Attempt (CVE-2026-42608)

Detects POST requests to Grav CMS FormFlash-related endpoints where the __form-flash-id or __unique_form_id__ session parameter, once URL-decoded, contains directory traversal sequences -- the direct HTTP-layer signature of CVE-2026-42608 exploitation used by ShinyHunters against Clop's Grav 1.7.43 leak site.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1595.002
  • Data sources: web_access_logs (Apache/Nginx combined), waf_logs, grav_application_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| where like(_raw, "%__form-flash-id%") OR like(_raw, "%__unique_form_id__%")
| rex field=_raw "(?i)(__form-flash-id|__unique_form_id__)=(?<flash_id_param>[^&]+)"
| eval flash_id_decoded=urldecode(flash_id_param)
| where like(flash_id_decoded, "%..%")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as targeted_paths values(flash_id_decoded) as payloads by src_ip, host, http_user_agent
| sort - count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("__form-flash-id", "__unique_form_id__")
| extend DecodedURL = url_decode(RequestURL)
| where DecodedURL contains ".."
| extend PayloadParam = extract(@"(__form-flash-id|__unique_form_id__)=([^&]+)", 2, DecodedURL)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Payloads = make_set(PayloadParam), TargetURLs = make_set(RequestURL) by SourceIP, DestinationHostName, DeviceProduct
| order by RequestCount desc

Sigma

title: Grav CMS FormFlash Path Traversal Exploitation Attempt (CVE-2026-42608)
id: 7f3c1e2a-9b4d-4a6e-8c2f-1a2b3c4d5e6f
status: experimental
description: Detects POST requests to Grav CMS form-handling endpoints containing path traversal sequences in the __form-flash-id or __unique_form_id__ parameters, indicating exploitation of CVE-2026-42608 (FormFlash arbitrary file write).
references:
    - https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2
    - https://www.bleepingcomputer.com/news/security/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw/
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
    - cve.2026.42608
logsource:
    category: webserver
detection:
    selection_method:
        cs-method: 'POST'
    selection_param:
        cs-uri-query|contains:
            - '__form-flash-id='
            - '__unique_form_id__='
    selection_traversal:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '..%2F'
            - '%2e%2e%2f'
    condition: selection_method and selection_param and selection_traversal
falsepositives:
    - Authorized penetration testers or vulnerability scanners validating CVE-2026-42608 against a sanctioned Grav instance
level: critical

Known false positives:

  • Authorized penetration testers or vulnerability scanners (e.g. Burp Suite, Nuclei) validating CVE-2026-42608 against a sanctioned Grav instance
  • Malformed client requests that coincidentally include '..' sequences in an otherwise benign session token

Tuning notes: Scope the index/sourcetype to the vhost(s) actually serving Grav; require >=2 hits from the same src_ip within 5 minutes before alerting to suppress single-request noise from crawlers.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Encoded/Evasive Path Traversal Against Grav FormFlash (WAF Bypass Attempt) · unlock with TL Creds
  • Grav Config File Read-Back Following FormFlash Traversal Write · unlock with TL Creds
  • Mass Webroot File Overwrite Consistent with Site Defacement · unlock with TL Creds
  • Grav CMS Recon-to-Exploit Chain Preceding FormFlash Path Traversal · unlock with TL Creds
  • Suspicious Shell Spawn from Grav Web Server Worker Process · unlock with TL Creds
  • Large Outbound Transfer or Tor Control-Port Access Following Grav Compromise · unlock with TL Creds
  • Grav FormFlash Arbitrary [indicator] Write Outside tmp/forms Directory · unlock with TL Creds
  • Bulk Access to Server Logs or Tor Onion-Service Private Keys on Compromised Grav Host · unlock with TL Creds

Indicators of compromise

As of 2026-09-26, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2671.

18 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

ShinyHunters then attempted to extort Clop for an eight-figure payment, escalating a rivalry that began over disputed ownership of the 2025 Oracle E-Business Suite exploit (CVE-2025-61882); Clop has publicly denied any relationship with ShinyHunters and disputed the value of what was taken.

On the night of September 18-19, 2026, the extortion group ShinyHunters compromised the Tor-hosted data leak site operated by the Clop ransomware gang. The intrusion vector was CVE-2026-42608, an unauthenticated path traversal vulnerability (CWE-22, CVSS 3.1 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) in the `Grav\Framework\Form\FormFlash` component of Grav CMS, the software running Clop's leak site (version 1.7.43). The vulnerable code builds a temporary upload directory path -- `$folder = $config['folder'] ?? ('tmp://forms/' . $this->sessionId)` -- from an attacker-controlled session identifier submitted as the `__form-flash-id` POST parameter (called `__unique_form_id__` in initial press reporting), without validating it as a safe filesystem path component. By supplying traversal sequences such as `../../../shhq` or the advisory's own proof-of-concept `../../user/config/proof_dir`, an unauthenticated attacker can escape the intended `tmp/forms/<session_id>/` directory and write an attacker-controlled `index.yaml` file to arbitrary writable locations inside the Grav installation.

Grav's maintainers privately received the vulnerability report from researcher sentinal404 on March 23, 2026, fixed it in the 2.x codebase on April 24, 2026 (commit d904efc33, adding a `sanitizeId()` allowlist restricting `session_id`/`unique_id`/`id` to `[A-Za-z0-9,_-]{1,64}`, after which invalid values collapse to an empty string and `save()`/`delete()`/`getTmpDir()` no-op), and published the advisory (GHSA-hmcx-ch82-3fv2 / CVE-2026-42608) on April 27, 2026 alongside Grav 2.0.0-beta.2. Critically, the fix was never backported to the still-widely-deployed 1.7.x branch, leaving installations such as Clop's Grav 1.7.43 leak site exposed for nearly five months until ShinyHunters exploited it; Clop's version was confirmed vulnerable, and the flaw affected the 1.6.x/1.7.x line through 1.7.49.5 as well as the early 2.0.0-beta.1 development build.

Using the flaw, ShinyHunters first uploaded a small taunting text file ('THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS...Maybe don't try to threaten us next time'), then, on the night of September 19, replaced the entire site with a full-page defacement featuring ASCII art of Umbreon -- the Pokemon character the group has used as its signature branding since a 2020 defacement of HackForums. ShinyHunters claims to have exfiltrated Grav CMS source code and plugins, server logs (reported as pulled from `/var/log`), and the private keys used by Clop's Tor onion service, stating in its own messaging that possessing those keys means 'if they kick us out it wouldn't matter... we control the private keys' -- i.e., that the stolen keys could let ShinyHunters resurrect or impersonate Clop's exact .onion address on infrastructure of its own choosing. BleepingComputer independently confirmed the defacement and the initial uploaded text file, but has not independently verified the broader claims of stolen source code, logs, or onion keys. Clop, for its part, publicly denied any relationship with ShinyHunters ('We do not know them, we have never worked with them, and at the moment we are not in contact with them') and downplayed the impact, claiming the compromised server 'contained nothing but content' with no data or financial activity present.

ShinyHunters then issued an extortion demand against Clop itself -- an eight-figure payment, a public apology, and a 72-hour deadline with threatened daily escalation -- and threatened to leak payment and Bitcoin-address details from Clop's victims in its 2025 Oracle E-Business Suite campaign. Clop responded publicly on its (recovered) site attempting to re-establish contact, later removed the target listing from ShinyHunters' own leak site (typically indicating active negotiation), and migrated its data leak site to a new Tor address. Grav backported the fix to the legacy branch as version 1.7.53.4 on September 24, 2026, immediately after the incident became public.

The attack is the latest escalation of a feud between ShinyHunters (operating since August 2025 under the loose 'Scattered Lapsus$ Hunters' banner, tracked by threat intelligence vendors as overlapping activity clusters UNC6240, UNC6661, UNC6671, UNC6040 and Bling Libra, with membership overlapping Scattered Spider and Lapsus$) and Clop, which began in October 2025 when Clop exploited the Oracle E-Business Suite zero-day CVE-2025-61882 (added to CISA's KEV catalog) in a mass-extortion campaign using a proof-of-concept exploit that ShinyHunters claims was originally theirs and was obtained without authorization; ShinyHunters alleges a Clop representative subsequently threatened members of the group, prompting this retaliatory breach. ShinyHunters' broader pattern is platform-scale, mass-victim exploitation rather than single-target intrusions -- prior campaigns have hit Snowflake-connected, Salesforce-connected, and Canvas-connected customer environments, and in June 2026 the group carried out its first significant zero-day campaign, exploiting a PeopleSoft vulnerability (CVE-2026-35273, CVSS 9.8) against more than 100 organizations, predominantly U.S. colleges and universities -- context that supports high-confidence attribution of this Grav CMS intrusion to the same actor set despite the technique here (an unauthenticated n-day path traversal) being comparatively unsophisticated.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.002 External Defacement; T1657 Financial Theft

Credential Access

T1552.004 Private Keys

Resource Development

T1584.004 Server

Reconnaissance

T1592.002 Software; T1594 Search Victim-Owned Websites; T1595.002 Vulnerability Scanning

Remediation

Patches

  • Grav 1.7.53.4 -- backported FormFlash sanitizeId() fix for the legacy 1.x branch, released 2026-09-24
  • Grav 2.0.0-beta.2 -- original FormFlash sanitizeId() fix, released April 2026

Immediate actions

  • Upgrade Grav CMS to 1.7.53.4 (legacy 1.x branch) or 2.0.0-beta.2+ (2.x branch) immediately
  • Rotate and regenerate any Tor onion-service private keys, API tokens, or credentials that were stored on or accessible from the affected Grav installation
  • Audit the webroot and tmp/forms/ directory tree for unexpected files or directories -- especially stray index.yaml files created outside the intended tmp/forms/<session_id>/ path -- as evidence of prior exploitation

Workarounds

  • Restrict or disable public/unauthenticated access to Grav's form submission and FormFlash endpoints until the patch is applied
  • Deploy a WAF or reverse-proxy rule blocking path-traversal sequences in form-related POST body parameters

Longer-term hardening

  • Enforce strict allowlist validation (e.g. Grav's own [A-Za-z0-9,_-]{1,64} pattern) on any user-supplied identifier used to construct filesystem paths
  • Run web application server processes with least-privilege, chrooted, or otherwise restricted filesystem write access to limit the blast radius of any future arbitrary-file-write bug
  • Monitor and alert on POST requests to form-handling endpoints (__form-flash-id, __unique_form_id__ or equivalent parameters) containing path traversal sequences ('../', '..%2f', '..\\')

Affected and fixed versions

  • Grav (Trilby Media LLC / getgrav) — Grav CMS
    Vulnerable versions: 1.6.x through 1.7.49.5 (confirmed exploited in 1.7.43); 2.0.0-beta.1
    Fixed in: 1.7.53.4 (1.x branch backport, 2026-09-24); 2.0.0-beta.2 (2.x branch, 2026-04-27)

Timeline

  • Clop exploits the Oracle E-Business Suite zero-day CVE-2025-61882 in a mass-extortion campaign using a proof-of-concept exploit ShinyHunters/Scattered Lapsus$ Hunters claims was originally theirs, sparking an ownership dispute and rivalry between the two groups.
  • Security researcher sentinal404 privately reports the Grav CMS FormFlash path traversal vulnerability to Grav maintainers.
  • Grav maintainers fix the FormFlash path traversal in commit d904efc33, adding a sanitizeId() allowlist for the 2.x codebase.
  • Grav publishes advisory GHSA-hmcx-ch82-3fv2 (CVE-2026-42608) and releases 2.0.0-beta.2; the fix is not backported to the still-supported 1.7.x branch.
  • ShinyHunters conducts its first major zero-day campaign, exploiting PeopleSoft vulnerability CVE-2026-35273 (CVSS 9.8) against more than 100 organizations, mostly U.S. colleges and universities -- establishing the platform-scale exploitation pattern later invoked to attribute the Clop breach.
  • ShinyHunters exploits CVE-2026-42608 against Clop's Grav 1.7.43-powered Tor leak site, uploading an initial taunting text file to prove access.
  • ShinyHunters replaces Clop's entire leak site with a full-page defacement featuring ASCII art of its Umbreon logo and a taunting message.
  • ShinyHunters issues an eight-figure extortion demand against Clop with a 72-hour deadline, threatening to leak Clop's Oracle campaign victim payment and Bitcoin-address data and demanding a public apology.
  • Clop publicly responds on its site attempting to re-establish contact with ShinyHunters and denies any relationship with the group; the incident is first widely reported by BleepingComputer and Infosecurity Magazine.
  • The Clop listing is quietly removed from ShinyHunters' own extortion leak site, an indicator commonly associated with active ransom negotiations.
  • Clop migrates its data leak site to a new Tor (.onion) address after confirming the prior server was compromised.
  • Grav releases version 1.7.53.4, backporting the FormFlash sanitizeId() fix to the legacy 1.x branch in response to the incident.
  • BleepingComputer publishes a detailed technical writeup of the exploit chain, confirming the defacement and initial uploaded file but noting the broader data-theft claims remain independently unverified.

Sources cited

More from ShinyHunters

Other reports on CVE-2025-61882

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats