Remote Code Execution Vulnerability in Grav Web Platform by GetGrav
CVE-2026-42607

9.1CRITICAL

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
11 May 2026

What is CVE-2026-42607?

An authenticated user with administrative privileges on the Grav platform can exploit a vulnerability by uploading a specially crafted ZIP file via the 'Direct Install' tool. This impacts the system's ability to properly inspect uploaded ZIP archives, allowing malicious PHP code to be executed or a persistent web shell to be dropped on the server. The vulnerability is effectively resolved in version 2.0.0-beta.2.

Affected Version(s)

grav < 2.0.0-beta.2

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/getgrav/grav/commit/5a12f9be8314682c87...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.