A Hidden Trick Inside a ZIP File Can Hand Hackers Full Control of Your Website

Security Desk  |  Vulnerability Analysis  |  Affects: Grav CMS < 2.0.0-beta.2

If your website runs on the Grav platform and an admin account ever gets compromised, an attacker could quietly bury malicious code inside a harmless-looking ZIP file — and walk away owning your entire server.

Who Should Be Worried

Grav is a popular, file-based content management platform used by developers, agencies, and organizations who prefer a lightweight alternative to WordPress or Drupal. It powers tens of thousands of websites globally — from portfolio sites to government portals — and is particularly favored by teams who want speed and simplicity without a database backend.

Every one of those sites running a version of Grav older than 2.0.0-beta.2 carries this vulnerability. While exploitation requires an authenticated administrator account, that's a lower bar than it sounds: phished credentials, password reuse, a disgruntled employee, or a session hijack can all put that access in an attacker's hands within minutes. Once they're in, this bug transforms a routine admin panel into a master key for the underlying server.

What's Actually Happening — No Jargon

Think of Grav's plugin installer like an app store for your website. Admins can upload ZIP files containing new plugins through a feature called "Direct Install," and the platform unpacks them and puts them to work. To keep things safe, Grav tries to block dangerous file types from being uploaded — specifically, it refuses to let you upload files ending in .php, which is the programming language that runs most of the web's server-side logic. Block the PHP files, block the danger. Simple enough, right?

Except there's a fatal gap in that logic. Grav checks what files you're directly uploading, but it never bothers to look inside a ZIP archive before unpacking it. So an attacker crafts a ZIP file that looks like a perfectly legitimate plugin on the outside. Hidden within it, however, is a PHP file loaded with malicious instructions. The moment Grav unzips the archive and installs the "plugin," that hidden PHP file lands on the server — and suddenly the attacker has a direct line into the system's core.

What happens next can range from catastrophic to quietly devastating. The attacker could run any command they want on the server — deleting files, stealing databases, exfiltrating user data. More insidiously, they can plant a "web shell": a tiny, persistent backdoor disguised among your website's files that lets them return at any time, even after you've changed your password, rotated keys, or patched the vulnerability itself. Cleaning up a web shell infestation is notoriously difficult and often requires forensic-level investigation.

The Technical Anchor

The vulnerability class — archive content bypass leading to server-side code execution — is well-documented in the broader security community and has appeared in other CMS platforms before. What elevates the risk here is the "Scope: Changed" designation in the CVSS scoring, meaning a successful exploit doesn't just compromise the Grav application — it can break out of the application's own boundaries and impact the underlying server infrastructure and any other services running on it.

Has This Been Exploited?

As of publication, no active exploitation has been confirmed in the wild, and no known threat campaigns have been attributed to this specific vulnerability. However, security teams should resist the temptation to treat "not yet exploited" as "safe." Once a CVE is public, the window between disclosure and weaponization has shrunk dramatically in recent years — sometimes to hours, not weeks.

The attack surface is meaningfully constrained by the requirement for admin credentials. That said, administrator accounts are routinely the target of credential-stuffing attacks, spearphishing campaigns, and infostealer malware — all of which could hand an attacker the keys they need. In shared hosting or multi-tenant environments where a single Grav instance serves multiple clients, the blast radius widens considerably.

"No active exploitation" is not a green light. It's a countdown timer."

The vulnerability was disclosed through responsible channels and a fix was issued by the Grav project team. No specific third-party researcher attribution has been publicly confirmed at this time.

What You Need to Do Right Now

The Bigger Picture

This vulnerability is a reminder that security filters are only as strong as their scope. Blocking a file type at the upload stage sounds protective — and in most cases it is — but attackers have learned to think one layer deeper. ZIP files, tar archives, and other containers have become a reliable smuggling mechanism precisely because many systems inspect the wrapper without examining the contents. This pattern has appeared across enterprise software, email gateways, and web applications for years, and it keeps working because it keeps being overlooked.

For the Grav community specifically, the fix in 2.0.0-beta.2 addresses the immediate problem. But the broader lesson — validate what's inside the container, not just the container itself — is one the entire web development ecosystem continues to learn the hard way.