An unauthenticated path traversal vulnerability in Grav CMS was exploited to compromise and deface the Clop ransomware gang's data leak site. This vulnerability enabled attackers to traverse directories on the server without authentication, resulting in unauthorized access and modification of the leak site. The incident forced the ransomware group to relocate their site to a new Tor address. No specific affected versions or technical details of the vulnerability were provided in the available information.

The vulnerability allowed unauthorized attackers to compromise and deface a high-profile ransomware gang's data leak site, demonstrating the potential for server takeover and content manipulation. This undermines the integrity and availability of the targeted site and could disrupt the gang's operations. There is no indication of broader impact beyond the leak site compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations using Grav CMS should monitor vendor communications for updates and consider implementing access restrictions or other compensating controls to mitigate path traversal risks.