A remote code execution vulnerability in Grav CMS versions prior to 2.0.0-beta.2 has been disclosed, allowing attackers with administrative access to execute arbitrary PHP code on the server.
The flaw, tracked as CVE-2026-42607, resides in the “Direct Install” feature of the Grav Admin plugin. This feature lets administrators upload plugins as ZIP files. The system failed to adequately validate ZIP archive contents or prevent path traversal — commonly known as a Zip Slip attack — during extraction.
An attacker can craft a malicious plugin that hooks into Grav events like onPluginsInitialized. Once uploaded through the admin panel, the plugin drops a persistent web shell on the server’s root directory, granting full system-level access under the web server user context.
The attack requires administrative privileges or could be triggered via CSRF. Grav CMS users should update to version 2.0.0-beta.2 or later immediately. If you’re running an older version and can’t patch right away, restrict admin panel access and monitor for unauthorized plugin installations.
