VulnerabilityPublished 25 Sep 2026

ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw

Source Bleeping Computer

Severity

Medium

Rated Medium by Threat Radar from the Bleeping Computer text

Data as of 28 Sep 2026, 04:42 UTC

ransomware

What to do

AI-suggested

Until an official fix is available, organizations using Grav CMS should monitor vendor communications for updates and consider implementing access restrictions or other compensating controls to mitigate path traversal risks.

Description

The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...]

Impact

The vulnerability allowed unauthorized attackers to compromise and deface a high-profile ransomware gang's data leak site, demonstrating the potential for server takeover and content manipulation. This undermines the integrity and availability of the targeted site and could disrupt the gang's operations. There is no indication of broader impact beyond the leak site compromise.

Summary

An unauthenticated path traversal vulnerability in Grav CMS was exploited to compromise and deface the Clop ransomware gang's data leak site. This vulnerability enabled attackers to traverse directories on the server without authentication, resulting in unauthorized access and modification of the leak site. The incident forced the ransomware group to relocate their site to a new Tor address. No specific affected versions or technical details of the vulnerability were provided in the available information.

References

bleepingcomputer.com/news/security/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 25 Sep 2026, 21:02 UTC

References

Community reviews

Related threats