Grav patches older CMS branch after Clop leak site breach

Grav has released version 1.7.53.4 to fix a path traversal flaw in its content management software after ShinyHunters used it to breach Clop's data leak site, BleepingComputer reports. The flaw lets an unauthenticated attacker manipulate a form upload path and write a file outside its intended directory. Grav confirmed the attacker's description of the vulnerability and said the fix had already been included in its 2.x branch but had not reached version 1.7. Clop moved its leak site to a new Tor address. ShinyHunters claims it stole operational files and private keys; Clop disputes that valuable data was on the server.