An authenticated administrator of the Grav file‑based web platform can upload a specially crafted ZIP archive through the "Direct Install" interface. The system blocks direct PHP uploads but does not inspect the contents of ZIP files, allowing a malicious plugin to be extracted and executed. This leads to arbitrary PHP code execution or the placement of a persistent web shell, providing attackers with full control over the web server.

The Grav content management system from getgrav is affected. All releases prior to 2.0.0‑beta.2 are vulnerable; versions 2.0.0‑beta.2 and newer contain the fix.

The vulnerability scores a CVSS of 9.1, indicating critical severity. EPSS data is not available, but case study availability in advisory links suggests it is being actively exploited. The vulnerability is not currently listed in the CISA KEV catalog. Because the exploit requires administrative authentication and the ability to use the Direct Install tool, the attack vector is credential‑based but trivial for compromised or privileged accounts. The high severity and the potential for total server compromise make this a top‑priority issue.