ShinyHunters Exploit Grav CMS Path Traversal (CVE-2026-42608) to Hack Clop Ransomware Gang's Leak Site

ShinyHunters Exploit Grav CMS Path Traversal (TL-2026-2671), also tracked as Clop Leak Site Hijack, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-09-26. It is attributed to ShinyHunters with high confidence, affects Grav (Trilby Media LLC / getgrav) Grav CMS, references 1 CVE (CVE-2026-42608), maps to 9 MITRE ATT&CK techniques (T1005, T1190, T1491.002), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-2671

Threat ID
TL-2026-2671
Also known as
Clop Leak Site Hijack
Severity
CRITICAL
CVSS
9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-26
Last reviewed
2026-09-26
Attribution
ShinyHunters
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
cybercriminal-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in ShinyHunters Exploit Grav CMS Path Traversal

Malware and tooling: Clop, scattered lapsus$ hunters, Umbreon

The ShinyHunters extortion group exploited an unauthenticated path traversal flaw (CVE-2026-42608) in Grav CMS's FormFlash form-upload component to breach and deface the Clop ransomware gang's Tor data leak site, claiming to have stolen source code, Grav plugins, server logs, and the private keys for Clop's onion service. ShinyHunters then attempted to extort Clop for an eight-figure payment, escalating a rivalry that began over disputed ownership of the 2025 Oracle E-Business Suite exploit (CVE-2025-61882); Clop has publicly denied any relationship with ShinyHunters and disputed the value of what was taken.

How ShinyHunters Exploit Grav CMS Path Traversal works

On the night of September 18-19, 2026, the extortion group ShinyHunters compromised the Tor-hosted data leak site operated by the Clop ransomware gang. The intrusion vector was CVE-2026-42608, an unauthenticated path traversal vulnerability (CWE-22, CVSS 3.1 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) in the `Grav\Framework\Form\FormFlash` component of Grav CMS, the software running Clop's leak site (version 1.7.43). The vulnerable code builds a temporary upload directory path -- `$folder = $config['folder'] ?? ('tmp://forms/' . $this->sessionId)` -- from an attacker-controlled session identifier submitted as the `__form-flash-id` POST parameter (called `__unique_form_id__` in initial press reporting), without validating it as a safe filesystem path component. By supplying traversal sequences such as `../../../shhq` or the advisory's own proof-of-concept `../../user/config/proof_dir`, an unauthenticated attacker can escape the intended `tmp/forms/<session_id>/` directory and write an attacker-controlled `index.yaml` file to arbitrary writable locations inside the Grav installation.

Grav's maintainers privately received the vulnerability report from researcher sentinal404 on March 23, 2026, fixed it in the 2.x codebase on April 24, 2026 (commit d904efc33, adding a `sanitizeId()` allowlist restricting `session_id`/`unique_id`/`id` to `[A-Za-z0-9,_-]{1,64}`, after which invalid values collapse to an empty string and `save()`/`delete()`/`getTmpDir()` no-op), and published the advisory (GHSA-hmcx-ch82-3fv2 / CVE-2026-42608) on April 27, 2026 alongside Grav 2.0.0-beta.2. Critically, the fix was never backported to the still-widely-deployed 1.7.x branch, leaving installations such as Clop's Grav 1.7.43 leak site exposed for nearly five months until ShinyHunters exploited it; Clop's version was confirmed vulnerable, and the flaw affected the 1.6.x/1.7.x line through 1.7.49.5 as well as the early 2.0.0-beta.1 development build.

Using the flaw, ShinyHunters first uploaded a small taunting text file ('THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS...Maybe don't try to threaten us next time'), then, on the night of September 19, replaced the entire site with a full-page defacement featuring ASCII art of Umbreon -- the Pokemon character the group has used as its signature branding since a 2020 defacement of HackForums. ShinyHunters claims to have exfiltrated Grav CMS source code and plugins, server logs (reported as pulled from `/var/log`), and the private keys used by Clop's Tor onion service, stating in its own messaging that possessing those keys means 'if they kick us out it wouldn't matter... we control the private keys' -- i.e., that the stolen keys could let ShinyHunters resurrect or impersonate Clop's exact .onion address on infrastructure of its own choosing. BleepingComputer independently confirmed the defacement and the initial uploaded text file, but has not independently verified the broader claims of stolen source code, logs, or onion keys. Clop, for its part, publicly denied any relationship with ShinyHunters ('We do not know them, we have never worked with them, and at the moment we are not in contact with them') and downplayed the impact, claiming the compromised server 'contained nothing but content' with no data or financial activity present.

ShinyHunters then issued an extortion demand against Clop itself -- an eight-figure payment, a public apology, and a 72-hour deadline with threatened daily escalation -- and threatened to leak payment and Bitcoin-address details from Clop's victims in its 2025 Oracle E-Business Suite campaign. Clop responded publicly on its (recovered) site attempting to re-establish contact, later removed the target listing from ShinyHunters' own leak site (typically indicating active negotiation), and migrated its data leak site to a new Tor address. Grav backported the fix to the legacy branch as version 1.7.53.4 on September 24, 2026, immediately after the incident became public.

The attack is the latest escalation of a feud between ShinyHunters (operating since August 2025 under the loose 'Scattered Lapsus$ Hunters' banner, tracked by threat intelligence vendors as overlapping activity clusters UNC6240, UNC6661, UNC6671, UNC6040 and Bling Libra, with membership overlapping Scattered Spider and Lapsus$) and Clop, which began in October 2025 when Clop exploited the Oracle E-Business Suite zero-day CVE-2025-61882 (added to CISA's KEV catalog) in a mass-extortion campaign using a proof-of-concept exploit that ShinyHunters claims was originally theirs and was obtained without authorization; ShinyHunters alleges a Clop representative subsequently threatened members of the group, prompting this retaliatory breach. ShinyHunters' broader pattern is platform-scale, mass-victim exploitation rather than single-target intrusions -- prior campaigns have hit Snowflake-connected, Salesforce-connected, and Canvas-connected customer environments, and in June 2026 the group carried out its first significant zero-day campaign, exploiting a PeopleSoft vulnerability (CVE-2026-35273, CVSS 9.8) against more than 100 organizations, predominantly U.S. colleges and universities -- context that supports high-confidence attribution of this Grav CMS intrusion to the same actor set despite the technique here (an unauthenticated n-day path traversal) being comparatively unsophisticated.

MITRE ATT&CK techniques used in TL-2026-2671

Collection

T1005 Data from Local System

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.002 External Defacement; T1657 Financial Theft

Credential Access

T1552.004 Private Keys

Resource Development

T1584.004 Server

Reconnaissance

T1592.002 Software; T1594 Search Victim-Owned Websites; T1595.002 Vulnerability Scanning

Affected products and versions in ShinyHunters Exploit Grav CMS Path Traversal

  • Grav (Trilby Media LLC / getgrav) — Grav CMS
    Vulnerable versions: 1.6.x through 1.7.49.5 (confirmed exploited in 1.7.43); 2.0.0-beta.1
    Fixed in: 1.7.53.4 (1.x branch backport, 2026-09-24); 2.0.0-beta.2 (2.x branch, 2026-04-27)

Remediation for ShinyHunters Exploit Grav CMS Path Traversal

Patches

  • Grav 1.7.53.4 -- backported FormFlash sanitizeId() fix for the legacy 1.x branch, released 2026-09-24
  • Grav 2.0.0-beta.2 -- original FormFlash sanitizeId() fix, released April 2026

Immediate actions

  • Upgrade Grav CMS to 1.7.53.4 (legacy 1.x branch) or 2.0.0-beta.2+ (2.x branch) immediately
  • Rotate and regenerate any Tor onion-service private keys, API tokens, or credentials that were stored on or accessible from the affected Grav installation
  • Audit the webroot and tmp/forms/ directory tree for unexpected files or directories -- especially stray index.yaml files created outside the intended tmp/forms/<session_id>/ path -- as evidence of prior exploitation

Workarounds

  • Restrict or disable public/unauthenticated access to Grav's form submission and FormFlash endpoints until the patch is applied
  • Deploy a WAF or reverse-proxy rule blocking path-traversal sequences in form-related POST body parameters

Longer-term hardening

  • Enforce strict allowlist validation (e.g. Grav's own [A-Za-z0-9,_-]{1,64} pattern) on any user-supplied identifier used to construct filesystem paths
  • Run web application server processes with least-privilege, chrooted, or otherwise restricted filesystem write access to limit the blast radius of any future arbitrary-file-write bug
  • Monitor and alert on POST requests to form-handling endpoints (__form-flash-id, __unique_form_id__ or equivalent parameters) containing path traversal sequences ('../', '..%2f', '..\\')

CVEs associated with ShinyHunters Exploit Grav CMS Path Traversal

CVE-2026-42608

Weaknesses (CWE) in ShinyHunters Exploit Grav CMS Path Traversal

CWE-22

Timeline of ShinyHunters Exploit Grav CMS Path Traversal

  • Clop exploits the Oracle E-Business Suite zero-day CVE-2025-61882 in a mass-extortion campaign using a proof-of-concept exploit ShinyHunters/Scattered Lapsus$ Hunters claims was originally theirs, sparking an ownership dispute and rivalry between the two groups.
  • Security researcher sentinal404 privately reports the Grav CMS FormFlash path traversal vulnerability to Grav maintainers.
  • Grav maintainers fix the FormFlash path traversal in commit d904efc33, adding a sanitizeId() allowlist for the 2.x codebase.
  • Grav publishes advisory GHSA-hmcx-ch82-3fv2 (CVE-2026-42608) and releases 2.0.0-beta.2; the fix is not backported to the still-supported 1.7.x branch.
  • ShinyHunters conducts its first major zero-day campaign, exploiting PeopleSoft vulnerability CVE-2026-35273 (CVSS 9.8) against more than 100 organizations, mostly U.S. colleges and universities -- establishing the platform-scale exploitation pattern later invoked to attribute the Clop breach.
  • ShinyHunters exploits CVE-2026-42608 against Clop's Grav 1.7.43-powered Tor leak site, uploading an initial taunting text file to prove access.
  • ShinyHunters replaces Clop's entire leak site with a full-page defacement featuring ASCII art of its Umbreon logo and a taunting message.
  • ShinyHunters issues an eight-figure extortion demand against Clop with a 72-hour deadline, threatening to leak Clop's Oracle campaign victim payment and Bitcoin-address data and demanding a public apology.
  • Clop publicly responds on its site attempting to re-establish contact with ShinyHunters and denies any relationship with the group; the incident is first widely reported by BleepingComputer and Infosecurity Magazine.
  • The Clop listing is quietly removed from ShinyHunters' own extortion leak site, an indicator commonly associated with active ransom negotiations.
  • Clop migrates its data leak site to a new Tor (.onion) address after confirming the prior server was compromised.
  • Grav releases version 1.7.53.4, backporting the FormFlash sanitizeId() fix to the legacy 1.x branch in response to the incident.
  • BleepingComputer publishes a detailed technical writeup of the exploit chain, confirming the defacement and initial uploaded file but noting the broader data-theft claims remain independently unverified.

Sources cited for ShinyHunters Exploit Grav CMS Path Traversal

More in vulnerability

Detection coverage for TL-2026-2671

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2671 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats