Grav RCE via Malicious Plugin Upload (CVE-2026-42607)

The National Vulnerability Database has detailed CVE-2026-42607, a critical Remote Code Execution (RCE) vulnerability in Grav, a file-based web platform. Prior to version 2.0.0-beta.2, an authenticated administrative user could achieve RCE by uploading a specially crafted ZIP file through the “Direct Install” tool. This flaw, rated 9.1 CVSS (Critical), stems from Grav’s failure to adequately inspect the contents of uploaded ZIP archives, despite blocking direct .php file uploads.

Attackers can exploit this by packaging a malicious plugin within a ZIP file. Once extracted, this plugin can execute arbitrary PHP code or drop a persistent web shell on the server. The vulnerability hinges on the assumption that an authenticated administrator won’t upload malicious content, which is a dangerous blind spot in security architecture. Insider threats, compromised admin accounts, or even social engineering could easily lead to exploitation.

For defenders, this is a clear reminder that file upload mechanisms, especially those handling archives, require robust content inspection beyond just file extensions. Trusting user input, even from authenticated users, for such critical operations is a fundamental security misstep. The fix is available in Grav version 2.0.0-beta.2, which addresses this oversight.