CVE-2026-42608 is a critical path traversal flaw (CVSS 9.1) in the FormFlash component of the Grav CMS. An unauthenticated attacker can create directories and write a YAML file with chosen content. The advisory lists fixes in 1.7.53.4 and 2.0.0-beta.2, so upgrade your branch.
What's affected
The NVD record says versions before 2.0.0-beta.2 are affected. The GitHub advisory lists two patched versions: 2.0.0-beta.2 and 1.7.53.4. The report confirmed the issue in 1.7.49.5, which was the latest stable release at the time.
If you run the 1.7 line, move to 1.7.53.4. If you run the 2.0 beta, move to 2.0.0-beta.2.
How to check if you're exposed
Read the version from the Grav install:
grep GRAV_VERSION system/defines.php
The admin panel also shows it on its dashboard. Then check whether your site has public forms, since the vulnerable code handles the form identifier sent with form posts. Review web server logs for POST requests where the form flash field contains parent directory sequences or odd path characters.
What to do now
- Upgrade to Grav 1.7.53.4 on the 1.7 line, or 2.0.0-beta.2 on the 2.0 line.
- After upgrading, review the Grav user and tmp folders and the wider web root for directories and index.yaml files you do not recognise.
- Run the web server as a user that can only write where Grav needs to write.
- Use a web application firewall rule or server config to reject form requests with path traversal sequences until you are patched.
- Back up the site before and after the upgrade.
Why it matters
The weakness is CWE-22, path traversal. The form flash identifier is taken from the request and used to build a folder path without cleaning it, so an attacker can walk out of the intended folder and create directories elsewhere. A YAML file with attacker controlled data is written there.
The advisory says this can change application behaviour, harm data integrity and disrupt service. Because no login is needed, any internet facing Grav site with forms was in scope. The KEV flag is false and the advisory does not describe exploitation in the wild.
Quick check
Which version should I install?
Use 1.7.53.4 if you are on Grav 1.7, and 2.0.0-beta.2 if you are on the 2.0 beta, as the advisory lists.
Sources
Last reviewed: 19 October 2026.
