ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
ShinyHunters defaced Clop's leak site via unpatched Grav CMS path traversal CVE-2026-42608; Grav patched the 1.7 branch.
The Clop ransomware gang moved its Tor leak site after ShinyHunters compromised and defaced the previous server. ShinyHunters said it stole source code, Grav plugins, server logs, and the onion service's private keys, then demanded a ransom; Clop said the unpatched server held only site content and denied any relationship or negotiations. Grav confirmed the bug as CVE-2026-42608, an unauthenticated path traversal in Grav core, present on Clop's Grav 1.7.43 install. The issue was fixed in Grav 2.0 earlier this year but not backported until Grav 1.7.53.4, and Grav urged remaining 1.7 sites to upgrade.
- ShinyHunters defaced Clop's Tor leak site and demanded a ransom.
- Clop said the server held only site content and denied talks.
- CVE-2026-42608 is an unauthenticated path traversal in Grav core.
- The fix is in Grav 2.0 and was backported as 1.7.53.4.
- CVEs
- CVE-2026-42608
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42608 | Grav: There is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as… | 8.8 | <1% | PoC |
From the original article
3 min read at bleepingcomputer.com
The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.