The **Clop** ransomware gang has migrated its data leak site to a new **Tor** address following the confirmation that its previous server was compromised. The breach, revealed by BleepingComputer, exploited an unauthenticated path traversal vulnerability within **Grav CMS**. Earlier this month, **ShinyHunters**, another extortion group, claimed responsibility for the breach. They initially uploaded a small text file, later replacing the entire **Clop** leak site with a defacement featuring their **Umbreon Pokémon** logo and a link to their own data leak site.  **ShinyHunters** subsequently asserted on their own site that they had stolen source code, **Grav CMS** plugins, server logs, and the private keys for **Clop**'s **Tor** onion service. They then issued a ransom demand, threatening to leak the stolen data if **Clop** did not comply. **Clop** has now announced a new onion address, stating the old domain will remain accessible temporarily before being decommissioned. The group also explicitly denied any relationship or ongoing negotiations with **ShinyHunters**. "We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so—either now or in the future," **Clop** informed BleepingComputer. When questioned about the breach's origin, **Clop** confirmed that their **Grav** installation had not been fully updated. However, the Russian ransomware gang disputed **ShinyHunters**' claims of valuable operational or financial data theft. "We didn't update the **Grav** plugin — though it happened eventually—but the server contained nothing but content (meaning there was absolutely no data or financial activity there, nor could there have been). Therefore, their claim is worthless—as are their words," **Clop** stated. Despite **Clop**'s denial of communication, they were quietly removed from **ShinyHunters**' data leak site, a common indicator of ongoing negotiations. When asked about the removal, **ShinyHunters** declined to comment further. ### Grav Confirms Flaw Used in Attack **Grav CMS** has since corroborated the vulnerability and exploitation details provided by **ShinyHunters** to BleepingComputer. **ShinyHunters** had disclosed that the compromised **Clop** server was running **Grav CMS 1.7.43** and claimed to have exploited an unauthenticated file upload flaw in **Grav**'s form upload handling. According to the threat actor, the vulnerable code used values from form-related POST parameters to create temporary upload directories without proper validation for safe filesystem path components. The group specifically identified the `__unique_form_id__` parameter. They stated that supplying directory traversal sequences, such as `../../../shhq`, for this identifier could manipulate **Grav** into creating an upload path outside the intended `tmp/forms` directory, allowing uploaded files to be written elsewhere within the **Grav** installation. Upon reviewing these technical details, **Grav** developers confirmed their accuracy. "Yes, it's a legitimate flaw, and the threat actor's description is accurate," **Grav** told BleepingComputer. **Grav** noted the flaw is tracked as **CVE-2026-42608**, a path traversal vulnerability that was privately reported and fixed in **Grav 2.0 (2.0.0-beta.2)** earlier this year, with an advisory published on April 27. The fix introduced a `sanitizeId()` function, which only accepts identifiers matching the allowlist `[A-Za-z0-9,_-]{1,64}`. This sanitization method aligns with the mitigation described by **ShinyHunters**. While current **Grav 2.x** releases were already protected, the fix had not been backported to the older **Grav 1.7** branch, leaving installations like **Clop**'s **1.7.43** deployment vulnerable. "The gap was the 1.7 line," **Grav** explained. "**Grav 2.0** is the current major version, but plenty of sites are still on 1.7, and that fix hadn't been backported there yet." After BleepingComputer shared the exploitation details, **Grav** developers backported the fix to the **1.7** branch and released **Grav 1.7.53.4** yesterday. They also clarified that the vulnerability resides in **Grav** core, not the Form plugin. "The bug lives in **Grav** core, not the Form plugin, so the Form plugin version (7.3.0 in their example) doesn't change whether a site is vulnerable. It's the core version that matters," **Grav** stated. **Grav** strongly advises anyone still using the **1.7** branch to upgrade to version **1.7.53.4**. Users of current **Grav 2.x** releases have been protected from this vulnerability for several months.