The vulnerability arises from Grav CMS’s Installer::unZip method, which calls ZipArchive::extractTo without imposing limits on uncompressed size, entry count, or directory depth. An attacker who has performed an admin.super login can exploit this by uploading a deliberately crafted ZIP archive through the Direct Install interface. The archive’s internal structure can be manipulated to occupy excessive disk space or trigger a crash. The resulting denial of service manifests as website unavailability or full disk on the host, impacting other services. This weakness corresponds to CWE-409, indicating improper resource management.

Grav CMS releases. Sites operating those versions and exposing the Direct Install function to admin.super users are at risk. The issue is corrected in Grav 2.0.0 and later.

The CVSS score of 6.9 classifies the flaw as moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation. Based on the description, it is inferred that no public exploits have been reported to date. The attack requires authenticated admin.super access, narrowing the threat surface to privileged users. An attacker can cause disk exhaustion or a crash, but cannot gain code execution or broader system compromise. The vulnerability is not listed in the CISA KEV catalog, indicating limited exploitation pressure.