Grav content management system versions prior to 2.0.1 contain a decompression bomb flaw in ZipArchiver::extract() that does not set limits on how much uncompressed data can be created. This weakness allows an attacker to supply a specially constructed ZIP archive that expands to consume all available storage, thereby triggering application or server outages. The flaw is classified as an uncontrolled resource consumption weakness, identified as CWE-409.

The vulnerability affects the Grav CMS from the vendor getgrav. All releases before version 2.0.1 are impacted; users must be running a vulnerable Grav instance at risk when the system processes uploaded or extracted ZIP archives.

The CVSS score is 7.1, indicating high severity for denial-of-service effects. The EPSS score is below 1%, implying a very low likelihood of exploitation at the moment. The vulnerability has not been listed in the CISA KEV catalog. Attackers would need to supply a malicious ZIP file to the Grav interface or API; once processed, the lack of size, file count, or nesting depth checks allows them to exhaust disk space, potentially bringing services to a halt.