ShinyHunters Exploit Grav CMS Path Traversal (CVE-2026-42608) to Hack Clop Ransomware Gang's Leak Site
ShinyHunters Exploit Grav CMS Path Traversal (TL-2026-2671), also tracked as Clop Leak Site Hijack, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-09-26. It is attributed to ShinyHunters with high confidence, affects Grav (Trilby Media LLC / getgrav) Grav CMS, references 1 CVE (CVE-2026-42608), maps to 9 MITRE ATT&CK techniques (T1005, T1190, T1491.002), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-2671
- Threat ID
- TL-2026-2671
- Also known as
- Clop Leak Site Hijack
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-26
- Last reviewed
- 2026-09-26
- Attribution
- ShinyHunters
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- cybercriminal-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in ShinyHunters Exploit Grav CMS Path Traversal
Malware and tooling: Clop, scattered lapsus$ hunters, Umbreon
The ShinyHunters extortion group exploited an unauthenticated path traversal flaw (CVE-2026-42608) in Grav CMS's FormFlash form-upload component to breach and deface the Clop ransomware gang's Tor data leak site, claiming to have stolen source code, Grav plugins, server logs, and the private keys for Clop's onion service. ShinyHunters then attempted to extort Clop for an eight-figure payment, escalating a rivalry that began over disputed ownership of the 2025 Oracle E-Business Suite exploit (CVE-2025-61882); Clop has publicly denied any relationship with ShinyHunters and disputed the value of what was taken.
How ShinyHunters Exploit Grav CMS Path Traversal works
On the night of September 18-19, 2026, the extortion group ShinyHunters compromised the Tor-hosted data leak site operated by the Clop ransomware gang. The intrusion vector was CVE-2026-42608, an unauthenticated path traversal vulnerability (CWE-22, CVSS 3.1 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) in the `Grav\Framework\Form\FormFlash` component of Grav CMS, the software running Clop's leak site (version 1.7.43). The vulnerable code builds a temporary upload directory path -- `$folder = $config['folder'] ?? ('tmp://forms/' . $this->sessionId)` -- from an attacker-controlled session identifier submitted as the `__form-flash-id` POST parameter (called `__unique_form_id__` in initial press reporting), without validating it as a safe filesystem path component. By supplying traversal sequences such as `../../../shhq` or the advisory's own proof-of-concept `../../user/config/proof_dir`, an unauthenticated attacker can escape the intended `tmp/forms/<session_id>/` directory and write an attacker-controlled `index.yaml` file to arbitrary writable locations inside the Grav installation.
Grav's maintainers privately received the vulnerability report from researcher sentinal404 on March 23, 2026, fixed it in the 2.x codebase on April 24, 2026 (commit d904efc33, adding a `sanitizeId()` allowlist restricting `session_id`/`unique_id`/`id` to `[A-Za-z0-9,_-]{1,64}`, after which invalid values collapse to an empty string and `save()`/`delete()`/`getTmpDir()` no-op), and published the advisory (GHSA-hmcx-ch82-3fv2 / CVE-2026-42608) on April 27, 2026 alongside Grav 2.0.0-beta.2. Critically, the fix was never backported to the still-widely-deployed 1.7.x branch, leaving installations such as Clop's Grav 1.7.43 leak site exposed for nearly five months until ShinyHunters exploited it; Clop's version was confirmed vulnerable, and the flaw affected the 1.6.x/1.7.x line through 1.7.49.5 as well as the early 2.0.0-beta.1 development build.
Using the flaw, ShinyHunters first uploaded a small taunting text file ('THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS...Maybe don't try to threaten us next time'), then, on the night of September 19, replaced the entire site with a full-page defacement featuring ASCII art of Umbreon -- the Pokemon character the group has used as its signature branding since a 2020 defacement of HackForums. ShinyHunters claims to have exfiltrated Grav CMS source code and plugins, server logs (reported as pulled from `/var/log`), and the private keys used by Clop's Tor onion service, stating in its own messaging that possessing those keys means 'if they kick us out it wouldn't matter... we control the private keys' -- i.e., that the stolen keys could let ShinyHunters resurrect or impersonate Clop's exact .onion address on infrastructure of its own choosing. BleepingComputer independently confirmed the defacement and the initial uploaded text file, but has not independently verified the broader claims of stolen source code, logs, or onion keys. Clop, for its part, publicly denied any relationship with ShinyHunters ('We do not know them, we have never worked with them, and at the moment we are not in contact with them') and downplayed the impact, claiming the compromised server 'contained nothing but content' with no data or financial activity present.
ShinyHunters then issued an extortion demand against Clop itself -- an eight-figure payment, a public apology, and a 72-hour deadline with threatened daily escalation -- and threatened to leak payment and Bitcoin-address details from Clop's victims in its 2025 Oracle E-Business Suite campaign. Clop responded publicly on its (recovered) site attempting to re-establish contact, later removed the target listing from ShinyHunters' own leak site (typically indicating active negotiation), and migrated its data leak site to a new Tor address. Grav backported the fix to the legacy branch as version 1.7.53.4 on September 24, 2026, immediately after the incident became public.
The attack is the latest escalation of a feud between ShinyHunters (operating since August 2025 under the loose 'Scattered Lapsus$ Hunters' banner, tracked by threat intelligence vendors as overlapping activity clusters UNC6240, UNC6661, UNC6671, UNC6040 and Bling Libra, with membership overlapping Scattered Spider and Lapsus$) and Clop, which began in October 2025 when Clop exploited the Oracle E-Business Suite zero-day CVE-2025-61882 (added to CISA's KEV catalog) in a mass-extortion campaign using a proof-of-concept exploit that ShinyHunters claims was originally theirs and was obtained without authorization; ShinyHunters alleges a Clop representative subsequently threatened members of the group, prompting this retaliatory breach. ShinyHunters' broader pattern is platform-scale, mass-victim exploitation rather than single-target intrusions -- prior campaigns have hit Snowflake-connected, Salesforce-connected, and Canvas-connected customer environments, and in June 2026 the group carried out its first significant zero-day campaign, exploiting a PeopleSoft vulnerability (CVE-2026-35273, CVSS 9.8) against more than 100 organizations, predominantly U.S. colleges and universities -- context that supports high-confidence attribution of this Grav CMS intrusion to the same actor set despite the technique here (an unauthenticated n-day path traversal) being comparatively unsophisticated.
MITRE ATT&CK techniques used in TL-2026-2671
Collection
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1491.002 External Defacement; T1657 Financial Theft
Credential Access
Resource Development
Reconnaissance
T1592.002 Software; T1594 Search Victim-Owned Websites; T1595.002 Vulnerability Scanning
Affected products and versions in ShinyHunters Exploit Grav CMS Path Traversal
- Grav (Trilby Media LLC / getgrav) — Grav CMS
Vulnerable versions: 1.6.x through 1.7.49.5 (confirmed exploited in 1.7.43); 2.0.0-beta.1
Fixed in: 1.7.53.4 (1.x branch backport, 2026-09-24); 2.0.0-beta.2 (2.x branch, 2026-04-27)
Remediation for ShinyHunters Exploit Grav CMS Path Traversal
Patches
- Grav 1.7.53.4 -- backported FormFlash sanitizeId() fix for the legacy 1.x branch, released 2026-09-24
- Grav 2.0.0-beta.2 -- original FormFlash sanitizeId() fix, released April 2026
Immediate actions
- Upgrade Grav CMS to 1.7.53.4 (legacy 1.x branch) or 2.0.0-beta.2+ (2.x branch) immediately
- Rotate and regenerate any Tor onion-service private keys, API tokens, or credentials that were stored on or accessible from the affected Grav installation
- Audit the webroot and tmp/forms/ directory tree for unexpected files or directories -- especially stray index.yaml files created outside the intended tmp/forms/<session_id>/ path -- as evidence of prior exploitation
Workarounds
- Restrict or disable public/unauthenticated access to Grav's form submission and FormFlash endpoints until the patch is applied
- Deploy a WAF or reverse-proxy rule blocking path-traversal sequences in form-related POST body parameters
Longer-term hardening
- Enforce strict allowlist validation (e.g. Grav's own [A-Za-z0-9,_-]{1,64} pattern) on any user-supplied identifier used to construct filesystem paths
- Run web application server processes with least-privilege, chrooted, or otherwise restricted filesystem write access to limit the blast radius of any future arbitrary-file-write bug
- Monitor and alert on POST requests to form-handling endpoints (__form-flash-id, __unique_form_id__ or equivalent parameters) containing path traversal sequences ('../', '..%2f', '..\\')
CVEs associated with ShinyHunters Exploit Grav CMS Path Traversal
CVE-2026-42608
Weaknesses (CWE) in ShinyHunters Exploit Grav CMS Path Traversal
CWE-22
Timeline of ShinyHunters Exploit Grav CMS Path Traversal
- Clop exploits the Oracle E-Business Suite zero-day CVE-2025-61882 in a mass-extortion campaign using a proof-of-concept exploit ShinyHunters/Scattered Lapsus$ Hunters claims was originally theirs, sparking an ownership dispute and rivalry between the two groups.
- Security researcher sentinal404 privately reports the Grav CMS FormFlash path traversal vulnerability to Grav maintainers.
- Grav maintainers fix the FormFlash path traversal in commit d904efc33, adding a sanitizeId() allowlist for the 2.x codebase.
- Grav publishes advisory GHSA-hmcx-ch82-3fv2 (CVE-2026-42608) and releases 2.0.0-beta.2; the fix is not backported to the still-supported 1.7.x branch.
- ShinyHunters conducts its first major zero-day campaign, exploiting PeopleSoft vulnerability CVE-2026-35273 (CVSS 9.8) against more than 100 organizations, mostly U.S. colleges and universities -- establishing the platform-scale exploitation pattern later invoked to attribute the Clop breach.
- ShinyHunters exploits CVE-2026-42608 against Clop's Grav 1.7.43-powered Tor leak site, uploading an initial taunting text file to prove access.
- ShinyHunters replaces Clop's entire leak site with a full-page defacement featuring ASCII art of its Umbreon logo and a taunting message.
- ShinyHunters issues an eight-figure extortion demand against Clop with a 72-hour deadline, threatening to leak Clop's Oracle campaign victim payment and Bitcoin-address data and demanding a public apology.
- Clop publicly responds on its site attempting to re-establish contact with ShinyHunters and denies any relationship with the group; the incident is first widely reported by BleepingComputer and Infosecurity Magazine.
- The Clop listing is quietly removed from ShinyHunters' own extortion leak site, an indicator commonly associated with active ransom negotiations.
- Clop migrates its data leak site to a new Tor (.onion) address after confirming the prior server was compromised.
- Grav releases version 1.7.53.4, backporting the FormFlash sanitizeId() fix to the legacy 1.x branch in response to the incident.
- BleepingComputer publishes a detailed technical writeup of the exploit chain, confirming the defacement and initial uploaded file but noting the broader data-theft claims remain independently unverified.
Sources cited for ShinyHunters Exploit Grav CMS Path Traversal
- ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
- ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
- [ZERO-DAY] Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component (GHSA-hmcx-ch82-3fv2)
- ShinyHunters Claim Hack of Rival Ransomware Gang Clop
- ShinyHunters hacks Clop ransomware gang and threatens extortion
- ShinyHunters Hacked Clop. Now What About Clop's Victims?
- ShinyHunters: 8 Facts About the Group That Hacked Clop
- CVE-2026-42608: Grav Path Traversal (CVSS 9.1) -- Fix & Details
- CVE-2026-42608 - Vulnerability Details
- CVE-2026-42608 NVD Record
- ShinyHunters Rooted Clop's Leak Site Through Grav CMS, and Now Wants to Extort the Extortionists
- ShinyHunters Hijacks Clop's Leak Site and Onion Keys
More in vulnerability
- Zero-Permission Android Apps Can Chain AtlasService and olc2 to Gain Root on OnePlus/OPPO Devices via OxygenOS Confused-Deputy Flaws
- Citrix NetScaler: Two Unpatched Zero-Day RCE Flaws Allegedly Exploited in the Wild (watchTowr Forensic Alert)
- CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud Orchestrator Auth Bypass, F5 BIG-IP APM Heap Overflow
- Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day (CVE-2026-93616) Actively Exploited
- Microsoft Titan Analytics JWT 'alg:none' Authentication Bypass Exposed Access to 17.3 Trillion ClickHouse Rows
Detection coverage for TL-2026-2671
As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2671 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.