ShinyHunters breached and defaced Clop’s data leak site by exploiting a Grav CMS flaw, according to details that Grav’s developers confirmed. Clop has since moved the site to a new Tor address.
ShinyHunters Defaced Clop’s Leak Site
ShinyHunters first placed a small file on Clop’s site earlier this month. It later replaced the site’s content with a full-page defacement promoting its own leak site.
The group claims it also stole source code, plugins, server logs and private keys for Clop’s Tor service. It subsequently demanded a ransom and threatened to release the files.
Clop confirmed that attackers compromised its server, but disputes the theft claims. The ransomware group says the server held only site content and no financial or operational data. Neither group has provided public evidence that settles what ShinyHunters obtained.
Path Traversal Allowed Files Outside the Intended Folder
ShinyHunters told BleepingComputer that Clop’s server ran Grav 1.7.43. The group said it manipulated a value used to build temporary form upload paths. By inserting directory traversal characters, it could direct file writes outside the intended folder.
Grav’s developers confirmed that the reported behavior reflects a genuine vulnerability in Grav core. The Grav CMS flaw allows an unauthenticated attacker to influence where the software writes files under a vulnerable installation. It carries the identifier CVE-2026-42608.
The issue lies in Grav itself, rather than the separate Form plugin. Therefore, updating that plugin alone does not address the vulnerable core code.
Grav Releases Fix for Older Installations
Grav fixed the path handling in its 2.0 branch earlier this year. However, it had not brought that protection to the widely used 1.7 branch when attackers breached Clop’s site.
After reviewing the attack details, Grav released version 1.7.53.4 on September 24. The update restricts the characters that Grav accepts in form identifiers, preventing attackers from using them to move file writes outside the intended temporary storage area.
Site owners who still run Grav 1.7 should update to version 1.7.53.4. Current Grav 2.x releases already include the fix.
0 responses to “ShinyHunters Breached Clop Leak Site Through Grav CMS Flaw”