ShinyHunters Defaces Clop Leak Site via Grav CMS Vulnerability
In late September 2026, the ShinyHunters extortion gang compromised the data leak site operated by the Clop ransomware group by exploiting an unpatched path traversal vulnerability in Grav CMS. The breach occurred after Clop failed to fully update its Grav installation, leaving it exposed to an attack that allowed ShinyHunters to upload files outside the intended directory structure.
Initially, ShinyHunters uploaded a small text file to confirm access, then replaced the entire leak site with a defacement page featuring their Umbreon Pokémon logo and a link to their own data leak platform. The group later claimed on their site that they had exfiltrated sensitive assets, including Grav CMS source code, plugins, server logs, and the private keys used by Clop’s Tor onion service.
ShinyHunters Issues Ransom Demand After Alleged Data Theft
Following the defacement, ShinyHunters issued a ransom demand, threatening to publish the stolen files unless Clop paid a ransom. The group asserted that the compromised server contained valuable operational and financial data, which they would leak if their demands were not met.
Clop responded by migrating to a new Tor onion address, stating the old domain would remain accessible temporarily before being retired. The ransomware gang denied any prior relationship or ongoing negotiations with ShinyHunters, telling BleepingComputer: "We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so—either now or in the future."
Clop Disputes ShinyHunters’ Claims, Confirms Outdated Grav CMS
When questioned about the breach, Clop confirmed that its Grav CMS installation had not been fully updated but disputed ShinyHunters’ claims of significant data theft. "We didn't update the Grav plugin — though it happened eventually—but the server contained nothing but content (meaning there was absolutely no data or financial activity there, nor could there have been). Therefore, their claim is worthless—as are their words," Clop stated.
The gang emphasized that the compromised server hosted only static content and no sensitive databases or financial systems, rendering the alleged theft of private keys or operational data implausible in their view.
Grav CMS Confirms Vulnerability as CVE-2026-42608
ShinyHunters provided BleepingComputer with technical details of the exploit, revealing they targeted CVE-2026-42608, an unauthenticated path traversal flaw in Grav CMS. According to the attackers, the vulnerability resided in how the system handled the __unique_form_id__ parameter during file uploads.
By submitting directory traversal sequences such as ../../../shhq in this parameter, ShinyHunters claimed they could manipulate Grav into creating upload paths outside the intended tmp/forms/ directory, allowing files to be written elsewhere in the web root.
After BleepingComputer shared these details with the Grav CMS development team, the project confirmed the accuracy of the description. "Yes, it's a legitimate flaw, and the threat actor's description is accurate," Grav stated. The vulnerability was traced to insufficient validation of user-supplied identifiers used in temporary path construction.
Patch Details and Mitigation Efforts
Grav confirmed that CVE-2026-42608 had been privately reported and fixed in Grav 2.0 (specifically 2.0.0-beta.2), with the security advisory published on April 27, 2026. The fix introduced a sanitizeId() function that restricts identifiers to the regex pattern [A-Za-z0-9,_-]{1,64}, effectively blocking path traversal attempts.
Although the patch was available in the Grav 2.x line, it had not been backported to the legacy 1.7 branch at the time of the attack. This left installations like Clop’s Grav 1.7.43 exposed despite the fix existing in newer versions.
Following disclosure, Grav backported the fix to the 1.7 branch and released Grav 1.7.53.4. The project urges all users still running Grav 1.7 to upgrade immediately. Users of Grav 2.x have been protected since the beta release earlier in the year.
Clarification on Vulnerability Location
Grav also clarified that the flaw resides in the Grav core, not in the Form plugin. "The bug lives in Grav core, not the Form plugin, so the Form plugin version (7.3.0 in their example) doesn't change whether a site is vulnerable. It's the core version that matters," the developers explained. This means that updating plugins alone would not mitigate the risk—core updates are essential.
The incident underscores the dangers of running outdated CMS versions, even when the software is perceived as lightweight or low-risk. Organizations using Grav 1.7 are strongly advised to apply the latest patch to prevent similar compromises.
Source: BleepingComputer