CVE-2026-42608 — Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as …
Published: 2026-05-11 · CVSS: 8.8 · CVSS 4.0
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7