critical9.1Public exploit code
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Grav CMS 2.0.0-beta.2 - Remote Code Execution2026-05-26 · webapps · php
Impact
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | getgrav/grav | < 2.0.0-beta.2 | 2.0.0-beta.2 |