CVE-2026-42608 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

What is CVE-2026-42608?

CVE-2026-42608 is a high-severity path traversal vulnerability in Getgrav Grav, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.

Weakness: CWE-22

Which versions are affected by CVE-2026-42608?

2 open source packages ship an affected version, including getgrav/grav. It affects 1 product.

Products include Getgrav Grav.

How do I fix CVE-2026-42608?

Upgrade getgrav/grav to 2.0.0-beta.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-42608 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42608 exists.

Other vulnerabilities in Getgrav Grav

• CVE-2023-34251 Grav Server Side Template Injection vulnerability Critical 10.0
• CVE-2025-46199 Cross-site scripting in n/a Critical 9.8
• CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) Critical 9.3
• CVE-2025-66844 Grav may be vulnerable to SSRF attack via Twig Templates Critical 9.1
• CVE-2022-2073 Code Injection in getgrav/grav Critical 9.1

All Getgrav Grav vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hmcx-ch82-3fv2.