Path Traversal Vulnerability in Grav Web Platform by Getgrav
CVE-2026-42608

8.8HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
11 May 2026

What is CVE-2026-42608?

Grav, a file-based web platform, features a path traversal vulnerability in its FormFlash core component prior to version 2.0.0-beta.2. By exploiting this flaw, an unauthenticated attacker can manipulate the session_id parameter in POST requests to traverse the filesystem. This could allow the attacker to create arbitrary directories and potentially write a malicious index.yaml file containing unauthorized data. Such exploitation may disrupt application behavior and lead to significant data integrity concerns in production environments. This vulnerability has been addressed in version 2.0.0-beta.2.

Affected Version(s)

grav < 2.0.0-beta.2

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.