CVE Intelligence
Analysis AI-assisted

CVE-2026-42607: Grav CMS: code injection via ZIP upload in Direct Install

CVE-2026-42607 affects Grav, a file-based web platform, in versions before 2.0.0-beta.2. An authenticated administrator can upload a crafted ZIP archive through the Direct Install tool, because archive contents are not inspected, which can lead to remote code execution. The record reports CVSS 3.1 9.1 (critical) and a fix in 2.0.0-beta.2, and the flaw is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Grav is a file-based web platform. CVE-2026-42607 is a code injection weakness (CWE-94) in its Direct Install tool: the upload filter blocks direct .php files but does not inspect files inside ZIP archives. The NVD record and the GitHub advisory indicate the issue is fixed in 2.0.0-beta.2.

Impact

  • An authenticated administrator may be able to execute arbitrary PHP code on the server.
  • A malicious plugin extracted from a crafted archive could leave a persistent web shell.
  • The record gives a CVSS 3.1 base score of 9.1 (critical), with high confidentiality, integrity and availability impact and a changed scope.

Affected products and versions

  • Grav versions prior to 2.0.0-beta.2, as stated in the record description.
  • The structured affected and fixes lists in the record are empty, so the version range comes only from the description text.

Exploitation status

The record shows the flaw is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted. The EPSS value in the record is 0.02251 (percentile 0.82468).

Remediation and mitigation

  • Upgrade Grav to 2.0.0-beta.2 or later, as indicated by the record and the linked commit.
  • Until patched, restrict administrative accounts to trusted staff, enforce strong authentication, and limit who can use plugin installation features.
  • Review the vendor advisory and the linked commit for details.

Detection guidance

  • Review logs of Direct Install usage and plugin installations for unexpected archive uploads or new plugin directories.
  • Look for unfamiliar PHP files in plugin directories and web-accessible locations, and compare file integrity against a trusted copy.
  • Monitor for unexpected outbound connections or scheduled tasks originating from the web server process.

Limitations of the available information

  • The record does not list affected or fixed versions in structured form.
  • The specific code path, prerequisites beyond administrative access, and exact archive handling details are not described in the available record.
  • Whether the fix is complete was not verified against the commit contents in this analysis.

Frequently asked questions

Which Grav versions are affected?

The record describes Grav versions prior to 2.0.0-beta.2 as affected. The structured version lists are empty, so check the advisory for exact ranges.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.