ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw

The ransomware group Clop had to relocate its dark-web leak portal after rival extortion crew ShinyHunters broke in and defaced it, later claiming to have stolen source code, plugins, server logs and the Tor service's private keys. Clop confirmed the intrusion but insists only non-sensitive content was exposed, denying any contact or dealings with ShinyHunters despite being quietly delisted from their victim site. ShinyHunters told BleepingComputer the attack abused an unauthenticated file-upload flaw in Grav CMS 1.7.43, where the __unique_form_id__ form parameter wasn't sanitized, letting attackers inject path-traversal sequences to write files outside the intended tmp/forms directory. Grav verified the report, tracked it as CVE-2026-42608, and noted the bug lived in Grav's core rather than the Form plugin; while Grav 2.0 had received a fix via a new sanitizeId() check back in April, that patch was never backported to the 1.7 branch until Grav rushed out version 1.7.53.4, which all remaining 1.7 users are urged to install immediately.