Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2026-42607 EUVD-2026-29065GHSA-w48r-jppp-rcfw

Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

Published May 11, 2026 · Updated May 12, 2026 · Assigned by GitHub_M

Vendor: getgrav Product: grav Package: getgrav/grav Ecosystem: Packagist

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.

Affected products

VendorProductAffectedFixed
getgrav grav < 2.0.0-beta.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist getgrav/grav < 2.0.0-beta.2 2.0.0-beta.2 GHSA-w48r-jppp-rcfw

References