CVE-2026-42607

{
  "id": "CVE-2026-42607",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T16:17:32.720",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the \"Direct Install\" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2."
    },
    {
      "lang": "es",
      "value": "Grav es una plataforma web basada en archivos. Antes de la versión 2.0.0-beta.2, un usuario autenticado con privilegios administrativos puede lograr Ejecución Remota de Código (RCE) al subir un archivo ZIP especialmente diseñado a través de la herramienta ’Instalación Directa’. Aunque el sistema intenta bloquear las subidas directas de archivos .PHP, no inspecciona el contenido de los archivos ZIP subidos. Una vez que un plugin malicioso es extraído, puede ejecutar código PHP arbitrario o dejar una web shell persistente en el servidor. Esta vulnerabilidad está corregida en la versión 2.0.0-beta.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "getgrav",
          "product": "grav",
          "versions": [
            {
              "version": "< 2.0.0-beta.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T13:46:17.028806Z",
          "id": "CVE-2026-42607",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-w48r-jppp-rcfw",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-w48r-jppp-rcfw",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}