PT-2026-37274 · Grav · Grav

Sentinal404

·

Published

2026-05-05

·

Updated

2026-05-13

·

CVE-2026-42608

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2
Description A path traversal issue exists within the FormFlash core component. An unauthenticated attacker can manipulate the session id (passed via the form-flash-id parameter in POST requests) to traverse the filesystem. This allows the creation of arbitrary directories and the writing of an index.yaml file containing attacker-controlled data. This can lead to unauthorized modification of application behavior, data integrity issues, and service disruption. The issue resides in the construct() and getTmpDir() functions of the GravFrameworkFormFormFlash class, where a lack of sanitization on the session id allows the use of ../ sequences to escape into writable directories such as user/config/, cache/, logs/, and tmp/.
Recommendations Update to version 2.0.0-beta.2. As a temporary workaround, restrict write permissions for the webserver on sensitive directories like user/config/ to prevent the creation of new subdirectories.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-42608
GHSA-HMCX-CH82-3FV2

Affected Products

Grav