Clop Hackers Exploit Grav CMS Flaw to Breach ShinyHunters

Clop ransomware operators recently migrated their data leak infrastructure to a new Tor address after confirming that their previous server had been compromised. The breach was facilitated by an unpatched Grav CMS flaw, specifically an unauthenticated path traversal vulnerability that allowed attackers to bypass security controls. Earlier this month, the ShinyHunters extortion gang seized control of the site, initially uploading a text file before replacing the entire interface with a defacement page featuring the Umbreon Pokémon logo and a link to their own leak portal.

ShinyHunters Claims Stolen Data and Ransom Demands

Following the intrusion, ShinyHunters asserted on their own platform that they had exfiltrated significant assets from the Clop server. These claimed thefts included source code, Grav CMS plugins, server logs, and the private keys associated with Clop’s Tor onion service. The group subsequently issued a ransom demand, threatening to publish the stolen materials if Clop failed to make payment. In response, Clop announced the new domain for its operations while noting that the old address would remain accessible temporarily before being retired.

The ransomware group explicitly denied any affiliation or ongoing dialogue with the intruders. “We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so,either now or in the future,” Clop stated in communications with BleepingComputer. When questioned about the nature of the breach, Clop admitted that its Grav installation had not been fully updated. However, the group disputed ShinyHunters’ assertions regarding the value of the stolen data, arguing that the server contained only static content without sensitive operational or financial records. “We didn’t update the Grav plugin , though it happened eventually,but the server contained nothing but content (meaning there was absolutely no data or financial activity there, nor could there have been). Therefore, their claim is worthless,as are their words,” Clop added.

Despite these public denials, Clop entries were quietly removed from ShinyHunters’ leak site, a move that typically signals active negotiations. When pressed for details regarding the removal, ShinyHunters declined to provide further comment.

Technical Details of the Vulnerability

Grav CMS developers have since verified the accuracy of the exploitation techniques described by ShinyHunters. According to the threat actor, the compromised server was running Grav CMS 1.7.43. ShinyHunters identified an unauthenticated file upload flaw within Grav’s form handling mechanism. The vulnerability stemmed from the use of values supplied through form-related POST parameters when creating temporary upload directories without validating them as safe filesystem components.

Specifically, the attack targeted the `uniqueformid` parameter. By injecting directory traversal sequences such as `../../../shhq` into this field, attackers could manipulate the resulting temporary path structure, which normally follows the format `tmp/forms/id>/id>`. This manipulation allowed the uploaded files to be written outside the intended `tmp/forms` directory and elsewhere within the Grav installation.

Grav confirmed that this description was accurate. “Yes, it’s a legitimate flaw, and the threat actor’s description is accurate,” Grav told BleepingComputer. The issue is tracked as CVE-2026-42608 and was privately reported earlier this year. It was fixed in Grav 2.0 (2.0.0-beta.2), with the advisory published on April 27. The fix introduced a `sanitizeId()` function designed to accept only identifiers matching the allowlist pattern `[A-Za-z0-9,_-]{1,64}`.

Remediation and Version Updates

While current Grav 2.x releases had been protected since the patch was applied, the fix was not initially backported to the older Grav 1.7 branch. This left legacy installations, including Clop’s version 1.7.43, exposed to the attack. Grav explained that the gap existed because many sites remained on the 1.7 line despite 2.0 being the current major version. “The gap was the 1.7 line,” Grav noted. “Grav 2.0 is the current major version, but plenty of sites are still on 1.7, and that fix hadn’t been backported there yet.”

Upon receiving the exploitation details from BleepingComputer, Grav developers backported the security fix to the 1.7 branch and released Grav 1.7.53.4. The developers also clarified that the vulnerability resided in the Grav core rather than the Form plugin. “The bug lives in Grav core, not the Form plugin, so the Form plugin version (7.3.0 in their example) doesn’t change whether a site is vulnerable. It’s the core version that matters,” Grav stated. Users remaining on the 1.7 branch are urged to upgrade immediately to version 1.7.53.4 to mitigate this critical security risk.