# ShinyHunters Exploit Grav CMS Path Traversal (CVE-2026-42608) to Hack Clop Ransomware Gang's Leak Site

> The ShinyHunters extortion group exploited an unauthenticated path traversal flaw (CVE-2026-42608) in Grav CMS's FormFlash form-upload component to breach and deface the Clop ransomware gang's Tor data leak site, claiming to have stolen source code, Grav plugins, server logs, and the private keys for Clop's onion service. ShinyHunters then attempted to extort Clop for an eight-figure payment, escalating a rivalry that began over disputed ownership of the 2025 Oracle E-Business Suite exploit (CVE-2025-61882); Clop has publicly denied any relationship with ShinyHunters and disputed the value of what was taken.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2671
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-shinyhunters-clop-leak-site-breach-tl-2026-2671.webp?v=8d6e3aac (Threadlinqs threat intel: CVE-2026-42608 Grav Path Traversal on Clop: Detection & IOCs (TL-2026-2671) — Critical severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-2671
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 (1 shown free below) · **IOCs:** 18
- **CVEs:** CVE-2026-42608, CVE-2025-61882

## Description

On the night of September 18-19, 2026, the extortion group ShinyHunters compromised the Tor-hosted data leak site operated by the Clop ransomware gang. The intrusion vector was CVE-2026-42608, an unauthenticated path traversal vulnerability (CWE-22, CVSS 3.1 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) in the `Grav\Framework\Form\FormFlash` component of Grav CMS, the software running Clop's leak site (version 1.7.43). The vulnerable code builds a temporary upload directory path -- `$folder = $config['folder'] ?? ('tmp://forms/' . $this->sessionId)` -- from an attacker-controlled session identifier submitted as the `__form-flash-id` POST parameter (called `__unique_form_id__` in initial press reporting), without validating it as a safe filesystem path component. By supplying traversal sequences such as `../../../shhq` or the advisory's own proof-of-concept `../../user/config/proof_dir`, an unauthenticated attacker can escape the intended `tmp/forms/<session_id>/` directory and write an attacker-controlled `index.yaml` file to arbitrary writable locations inside the Grav installation.

Grav's maintainers privately received the vulnerability report from researcher sentinal404 on March 23, 2026, fixed it in the 2.x codebase on April 24, 2026 (commit d904efc33, adding a `sanitizeId()` allowlist restricting `session_id`/`unique_id`/`id` to `[A-Za-z0-9,_-]{1,64}`, after which invalid values collapse to an empty string and `save()`/`delete()`/`getTmpDir()` no-op), and published the advisory (GHSA-hmcx-ch82-3fv2 / CVE-2026-42608) on April 27, 2026 alongside Grav 2.0.0-beta.2. Critically, the fix was never backported to the still-widely-deployed 1.7.x branch, leaving installations such as Clop's Grav 1.7.43 leak site exposed for nearly five months until ShinyHunters exploited it; Clop's version was confirmed vulnerable, and the flaw affected the 1.6.x/1.7.x line through 1.7.49.5 as well as the early 2.0.0-beta.1 development build.

Using the flaw, ShinyHunters first uploaded a small taunting text file ('THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS...Maybe don't try to threaten us next time'), then, on the night of September 19, replaced the entire site with a full-page defacement featuring ASCII art of Umbreon -- the Pokemon character the group has used as its signature branding since a 2020 defacement of HackForums. ShinyHunters claims to have exfiltrated Grav CMS source code and plugins, server logs (reported as pulled from `/var/log`), and the private keys used by Clop's Tor onion service, stating in its own messaging that possessing those keys means 'if they kick us out it wouldn't matter... we control the private keys' -- i.e., that the stolen keys could let ShinyHunters resurrect or impersonate Clop's exact .onion address on infrastructure of its own choosing. BleepingComputer independently confirmed the defacement and the initial uploaded text file, but has not independently verified the broader claims of stolen source code, logs, or onion keys. Clop, for its part, publicly denied any relationship with ShinyHunters ('We do not know them, we have never worked with them, and at the moment we are not in contact with them') and downplayed the impact, claiming the compromised server 'contained nothing but content' with no data or financial activity present.

ShinyHunters then issued an extortion demand against Clop itself -- an eight-figure payment, a public apology, and a 72-hour deadline with threatened daily escalation -- and threatened to leak payment and Bitcoin-address details from Clop's victims in its 2025 Oracle E-Business Suite campaign. Clop responded publicly on its (recovered) site attempting to re-establish contact, later removed the target listing from ShinyHunters' own leak site (typically indicating active negotiation), and migrated its data leak site to a new Tor address. Grav backported the fix to the legacy branch as version 1.7.53.4 on September 24, 2026, immediately after the incident became public.

The attack is the latest escalation of a feud between ShinyHunters (operating since August 2025 under the loose 'Scattered Lapsus$ Hunters' banner, tracked by threat intelligence vendors as overlapping activity clusters UNC6240, UNC6661, UNC6671, UNC6040 and Bling Libra, with membership overlapping Scattered Spider and Lapsus$) and Clop, which began in October 2025 when Clop exploited the Oracle E-Business Suite zero-day CVE-2025-61882 (added to CISA's KEV catalog) in a mass-extortion campaign using a proof-of-concept exploit that ShinyHunters claims was originally theirs and was obtained without authorization; ShinyHunters alleges a Clop representative subsequently threatened members of the group, prompting this retaliatory breach. ShinyHunters' broader pattern is platform-scale, mass-victim exploitation rather than single-target intrusions -- prior campaigns have hit Snowflake-connected, Salesforce-connected, and Canvas-connected customer environments, and in June 2026 the group carried out its first significant zero-day campaign, exploiting a PeopleSoft vulnerability (CVE-2026-35273, CVSS 9.8) against more than 100 organizations, predominantly U.S. colleges and universities -- context that supports high-confidence attribution of this Grav CMS intrusion to the same actor set despite the technique here (an unauthenticated n-day path traversal) being comparatively unsophisticated.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1594 Search Victim-Owned Websites
- T1584.004 Server
- T1190 Exploit Public-Facing Application
- T1005 Data from Local System
- T1552.004 Private Keys
- T1491.002 External Defacement
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Grav CMS FormFlash Path Traversal Exploitation Attempt (CVE-2026-42608)** (`TL-2026-2671-SPL-001`)

Detects POST requests to Grav CMS FormFlash-related endpoints where the __form-flash-id or __unique_form_id__ session parameter, once URL-decoded, contains directory traversal sequences -- the direct HTTP-layer signature of CVE-2026-42608 exploitation used by ShinyHunters against Clop's Grav 1.7.43 leak site.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.002
- **Data sources:** web_access_logs (Apache/Nginx combined), waf_logs, grav_application_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| where like(_raw, "%__form-flash-id%") OR like(_raw, "%__unique_form_id__%")
| rex field=_raw "(?i)(__form-flash-id|__unique_form_id__)=(?<flash_id_param>[^&]+)"
| eval flash_id_decoded=urldecode(flash_id_param)
| where like(flash_id_decoded, "%..%")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as targeted_paths values(flash_id_decoded) as payloads by src_ip, host, http_user_agent
| sort - count
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("__form-flash-id", "__unique_form_id__")
| extend DecodedURL = url_decode(RequestURL)
| where DecodedURL contains ".."
| extend PayloadParam = extract(@"(__form-flash-id|__unique_form_id__)=([^&]+)", 2, DecodedURL)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Payloads = make_set(PayloadParam), TargetURLs = make_set(RequestURL) by SourceIP, DestinationHostName, DeviceProduct
| order by RequestCount desc
```

### Sigma

```yaml
title: Grav CMS FormFlash Path Traversal Exploitation Attempt (CVE-2026-42608)
id: 7f3c1e2a-9b4d-4a6e-8c2f-1a2b3c4d5e6f
status: experimental
description: Detects POST requests to Grav CMS form-handling endpoints containing path traversal sequences in the __form-flash-id or __unique_form_id__ parameters, indicating exploitation of CVE-2026-42608 (FormFlash arbitrary file write).
references:
    - https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2
    - https://www.bleepingcomputer.com/news/security/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw/
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
    - cve.2026.42608
logsource:
    category: webserver
detection:
    selection_method:
        cs-method: 'POST'
    selection_param:
        cs-uri-query|contains:
            - '__form-flash-id='
            - '__unique_form_id__='
    selection_traversal:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '..%2F'
            - '%2e%2e%2f'
    condition: selection_method and selection_param and selection_traversal
falsepositives:
    - Authorized penetration testers or vulnerability scanners validating CVE-2026-42608 against a sanctioned Grav instance
level: critical
```

**Known false positives:**

- Authorized penetration testers or vulnerability scanners (e.g. Burp Suite, Nuclei) validating CVE-2026-42608 against a sanctioned Grav instance
- Malformed client requests that coincidentally include '..' sequences in an otherwise benign session token

**Tuning notes:** Scope the index/sourcetype to the vhost(s) actually serving Grav; require >=2 hits from the same src_ip within 5 minutes before alerting to suppress single-request noise from crawlers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Encoded/Evasive Path Traversal Against Grav FormFlash (WAF Bypass Attempt) (locked: unlock with TL Creds)
- Grav Config File Read-Back Following FormFlash Traversal Write (locked: unlock with TL Creds)
- Mass Webroot File Overwrite Consistent with Site Defacement (locked: unlock with TL Creds)
- Grav CMS Recon-to-Exploit Chain Preceding FormFlash Path Traversal (locked: unlock with TL Creds)
- Suspicious Shell Spawn from Grav Web Server Worker Process (locked: unlock with TL Creds)
- Large Outbound Transfer or Tor Control-Port Access Following Grav Compromise (locked: unlock with TL Creds)
- Grav FormFlash Arbitrary [indicator] Write Outside tmp/forms Directory (locked: unlock with TL Creds)
- Bulk Access to Server Logs or Tor Onion-Service Private Keys on Compromised Grav Host (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw](https://www.bleepingcomputer.com/news/security/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw/)
- [ShinyHunters hacks Clop leak site, threatens to extort ransomware gang](https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/)
- [ZERO-DAY Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component (GHSA-hmcx-ch82-3fv2)](https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2)
- [ShinyHunters Claim Hack of Rival Ransomware Gang Clop](https://www.infosecurity-magazine.com/news/shinyhunters-claim-hack-of-clop/)
- [ShinyHunters hacks Clop ransomware gang and threatens extortion](https://cybernews.com/news/shinyhunters-hacks-clop-ransomware/)
- [ShinyHunters Hacked Clop. Now What About Clop's Victims?](https://www.darkreading.com/cyberattacks-data-breaches/shinyhunters-hacked-clop-what-about-clops-victims)
- [ShinyHunters: 8 Facts About the Group That Hacked Clop](https://cybelangel.com/blog/shinyhunters-8-things-we-know/)
- [CVE-2026-42608: Grav Path Traversal (CVSS 9.1) -- Fix & Details](https://www.strix.ai/cve/CVE-2026-42608)
- [CVE-2026-42608 - Vulnerability Details](https://app.opencve.io/cve/CVE-2026-42608)
- [CVE-2026-42608 NVD Record](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-42608)
- [ShinyHunters Rooted Clop's Leak Site Through Grav CMS, and Now Wants to Extort the Extortionists](https://dev.to/etairos/shinyhunters-rooted-clops-leak-site-through-grav-cms-and-now-wants-to-extort-the-extortionists-1gl0)
- [ShinyHunters Hijacks Clop's Leak Site and Onion Keys](https://www.gblock.app/articles/shinyhunters-clop-leak-site-hijack-2026)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2671