ShinyHunters breached Clop's leak site through an unpatched Grav path traversal flaw

The exploit needs no login. Grav's form upload handler built a temporary directory out of values sent in form-related POST parameters, without checking that those values were safe path components ^[16]. ShinyHunters pointed to the `__unique_form_id__` parameter, whose value dropped into a path shaped like `tmp/forms/<session_id>/<unique_id>` ^[16]. Send `../../../shhq` as that identifier and Grav creates the upload path outside `tmp/forms`, so the file lands elsewhere under the installation ^[17].

Grav agreed once BleepingComputer showed it the method. "Yes, it's a legitimate flaw, and the threat actor's description is accurate," the developers said ^[14]. Their fix added a `sanitizeId()` function that accepts only identifiers matching `[A-Za-z0-9,_-]{1,64}`, which is exactly the mitigation ShinyHunters had described ^[19]. Grav also placed the bug in core, not the Form plugin ^[23].

The release history is why this reaches past Clop. "The gap was the 1.7 line," Grav said. "Grav 2.0 is the current major version, but plenty of sites are still on 1.7, and that fix hadn't been backported there yet." ^[21]

On what left the server, the two gangs tell different stories. ShinyHunters claimed it took source code, Grav plugins, server logs and the private keys for Clop's Tor onion service, then demanded payment to keep the files private ^[4]. Clop admitted its Grav install was behind ^[8] and denied any dealings with ShinyHunters ^[6]. Clop said it had not updated the Grav plugin, though it did eventually, but that the server held nothing but content, with no data or financial activity there and no possibility of any, so ShinyHunters' claim and its words were worthless ^[10]. Clop has since been quietly removed from ShinyHunters' leak site, which BleepingComputer notes usually signals negotiations; asked about it, ShinyHunters would not answer further ^[11][12].