Zero Installation, Total Compromise: Critical Grav CMS Exploit Chain Grants Unauthenticated RCE

This advisory describes two critical Grav CMS vulnerabilities (CVE-2026-42613 and CVE-2026-42607) that enable an unauthenticated attacker to self-register with super-admin privileges by abusing missing server-side validation in the Login plugin, then chain that access to perform remote code execution through unsafe ZIP extraction in the Direct Install/GPM feature; administrators are urged to update to Grav 2.0.0-beta.2 or later immediately.