CVE-2026-42607 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-42607 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-42607 is an authenticated remote code execution vulnerability in Grav, an open-source file-based web content management platform, exploitable by an attacker with administrative credentials via the file upload functionality.

Technical Detail

The flaw exists in Grav versions prior to 2.0.0-beta.2 and allows an authenticated administrator to achieve remote code execution by uploading a specially crafted ZIP file through the platform's administrative interface. The ZIP file likely contains malicious content that is extracted and executed server-side without sufficient validation or path sanitization, a class of vulnerability commonly referred to as a ZIP slip or unsafe archive extraction issue. Successful exploitation grants the attacker arbitrary code execution in the context of the web server process, potentially enabling full system compromise depending on the host environment's privilege configuration.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning there is no confirmed public proof-of-concept or evidence of active exploitation in the wild as of May 18, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence sources.

What To Do

Administrators running Grav should upgrade to version 2.0.0-beta.2 or later as the primary remediation action. Given the authentication requirement, organizations should also audit administrative account access, enforce strong credentials, and apply the principle of least privilege to limit the number of accounts with administrative roles. As an interim measure where patching is not immediately possible, restricting access to the Grav administrative interface to trusted IP ranges or VPN-only connections will reduce the attack surface. Monitor web server logs for unusual file upload activity and unexpected process execution originating from the web server user account as detection signals.