The Clop ransomware gang moved its data-leak site to a new Tor address after confirming that the site’s previous server had been breached and defaced through an unpatched vulnerability in the Grav CMS content management system. BleepingComputer determined that the flaw was an undocumented path traversal vulnerability that required unauthenticated access to the site.
The breach occurred earlier in September, when the ShinyHunters extortion group uploaded a small text file to the site and then replaced its contents with a full defacement page featuring the logo of the Umbreon character from Pokémon and a link to its leak site. The group later said it had stolen the source code, Grav plugins, server logs, and the private keys used to operate Clop’s Tor service, and demanded a ransom in exchange for not publishing the files.
What happened on Clop’s server?
Clop acknowledged that the Grav installation on the server was not fully up to date, but denied that the servers contained important operational or financial data. It said the server contained only the site’s content, and also denied having any relationship or ongoing negotiations with ShinyHunters. According to the report, ShinyHunters later removed Clop’s name from its site without providing any additional explanation.
The server was running Grav 1.7.43. According to details provided by ShinyHunters, Grav’s file-upload processing method was exploited by passing an unsafe value in the __unique_form_id__ parameter. This value was used to create a temporary path in the format tmp/forms/<session_id>/<unique_id> without first verifying that it was a safe component for a file path.
By entering traversal sequences such as ../../../shhq, Grav could be forced to create a path outside the directory designated for uploaded files, allowing the uploaded file to be written elsewhere within the system installation.
Confirmation of the flaw and release of the fix
Grav reviewed the technical details shared by BleepingComputer, and the system’s developers confirmed that the attacker’s description of the flaw was accurate. The vulnerability was assigned the identifier CVE-2026-42608. It was first fixed in Grav 2.0, the experimental release 2.0.0-beta.2, with the security advisory published on April 27.
The fix added a sanitizeId() function that accepts only identifiers matching the allowlist [A-Za-z0-9,_-]{1,64}. Grav explained that the flaw is in the system core, not in the Form plugin; therefore, the plugin version, including version 7.3.0 mentioned in the case, does not determine whether a site is vulnerable.
What changes in practice?
Current Grav 2.x releases had been protected for months, but the fix had not yet been backported to the 1.7 branch, which is still used by many sites. After the exploit details were shared with the developers, Grav released version 1.7.53.4 for the 1.7 branch and urged users of that branch to upgrade to it.
The incident shows that relying on an older branch of a content management system can leave a known vulnerability in the core component even when the plugin associated with the functionality is up to date. Moving the leak site to a new address addresses the operational impact of the breach for Clop, but by itself does not establish whether the files ShinyHunters claimed to have stolen actually included sensitive data; Clop denied this, and the source provided no independent evidence resolving the claim.