ShinyHunters Defaced Clop Leak Site Through Grav CMS Path Traversal Flaw
Summary
Clop moved its leak site after ShinyHunters compromised and defaced its server through a Grav CMS path traversal flaw. Grav confirmed CVE-2026-42608 and released a fix for the 1.7 branch; Clop disputes the group’s theft claims.
Key points
- ShinyHunters defaced Clop’s leak site, prompting Clop to move it to a new Tor address.
- ShinyHunters claimed it stole source code, plugins, server logs, and private keys; Clop disputed that valuable data was stolen.
- Clop acknowledged its Grav installation was not fully updated.
- Grav confirmed CVE-2026-42608 is an unauthenticated path traversal flaw in Grav core, not the Form plugin.
- The flaw involved an unvalidated form-related identifier used to create temporary upload paths, according to the attacker’s technical description, which Grav said was accurate.
- Grav backported the fix to version 1.7.53.4 and urged users on the 1.7 branch to upgrade; current Grav 2.x releases were already protected.
Article Details
- Victim Organization
- Clop
- Incident Type
- Unauthenticated path traversal vulnerability in Grav CMS used to compromise and deface Clop's leak site.
- Data Types Exposed
- Source code
- Grav CMS plugins
- Server logs
- Private keys used by Clop's Tor onion service
- Operational Impact
- Clop's previous leak-site server was compromised and defaced, and Clop moved its data leak site to a new Tor address. Clop disputed that valuable operational or financial data was stolen.
- Ransom Or Extortion
- ShinyHunters claimed to have stolen files and threatened to leak them unless Clop paid a ransom. Clop disputed the value and significance of the claimed stolen data.
- Claim Status
- alleged