CVE-2026-42608 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-42608 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-42608 is a path traversal vulnerability in the FormFlash core component of Grav, a file-based web content management platform developed by Getgrav.

Technical Detail

The flaw exists in how Grav's FormFlash component processes the session identifier passed via the __form-flash-id parameter in POST requests. An attacker can manipulate this value to traverse the server's directory structure outside of the intended working path, potentially reading or writing arbitrary files accessible to the web server process. Depending on server configuration and file permissions, successful exploitation could lead to sensitive file disclosure, configuration exposure, or file write primitives that enable further compromise such as remote code execution.

Exploitation Status

No known exploit code has been identified at this time, and this CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning public proof-of-concept code or active in-the-wild exploitation has not been confirmed as of this briefing date.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence sources.

What To Do

Upgrade Grav to version 2.0.0-beta.2 or later, which contains the fix for this path traversal issue. Organizations running any version of Grav prior to 2.0.0-beta.2 should treat this as a priority patch given the critical CVSS score of 9.1. If immediate patching is not feasible, restrict external access to form submission endpoints and ensure the web server process runs under a least-privilege account with tightly scoped file system permissions to limit traversal impact. Monitor web server logs for POST requests containing directory traversal sequences such as ../ or URL-encoded equivalents in the __form-flash-id parameter as a detection signal.