The Clop ransomware gang has relocated its data leak site to a new Tor address after acknowledging that its previous server was compromised and defaced through an unpatched vulnerability in the Grav content management system. The breach was carried out earlier this month by the ShinyHunters extortion gang, which initially uploaded a small text file before replacing the site with a full-page defacement featuring its Umbreon Pokemon logo and a link to its own leak site.
ShinyHunters has claimed on its own site that it stole source code, Grav CMS plugins, server logs and the private keys used by Clop's Tor onion service, then issued a ransom demand threatening to publish the files if Clop did not pay. Clop has announced the new onion address and said the old domain will remain accessible temporarily before being retired. The gang also denied any relationship or negotiations with ShinyHunters, stating that it does not know them, has never worked with them and is not in contact with them, and that it has not provided them with any information.
Clop confirmed to BleepingComputer that its Grav installation had not been fully updated and that its Grav plugin was not updated until eventually. The gang disputed ShinyHunters' claims that valuable operational or financial data was taken, saying the server held nothing but content and no data or financial activity, making the claims worthless. ShinyHunters has since quietly removed Clop from its data leak site, a step that commonly occurs when negotiations are underway; when asked about the removal, ShinyHunters declined to answer further questions.
Grav CMS has confirmed that the vulnerability and exploitation details ShinyHunters provided are accurate. ShinyHunters said the compromised Clop server ran Grav CMS 1.7.43 and that it exploited an unauthenticated file upload flaw in Grav's form upload handling. According to the group, the vulnerable code used values supplied through form-related POST parameters when creating temporary upload directories without first validating them as safe filesystem path components.
ShinyHunters specifically identified the __unique_form_id__ parameter, saying it was inserted into a temporary path. The group claimed that by supplying directory traversal sequences, it could cause Grav to create an upload path outside the intended temporary forms directory, allowing an uploaded file to be written elsewhere under the Grav installation.
Grav told BleepingComputer that the flaw is legitimate and that the threat actor's description is accurate. The vulnerability is tracked as CVE-2026-42608 and is a path traversal issue that was privately reported and fixed in Grav 2.0 (2.0.0-beta.2) earlier this year, with an advisory published on April 27. The fix added a sanitizeId() function that accepts only identifiers matching an allowlist, the same mitigation ShinyHunters described.
Grav said that while current 2.x releases were protected, the fix had not been backported to the older 1.7 branch, leaving installations such as Clop's 1.7.43 deployment vulnerable. The company described the gap as the 1.7 line, noting that Grav 2.0 is the current major version but that plenty of sites remain on 1.7 and the fix had not yet been backported there.
More cybersecurity news from TechManNews.
