Description
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.
Published: 2026-08-19
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Grav ZipArchiver component fails to enforce extraction limits, allowing an attacker‑controlled ZIP archive to exhaust disk space or inodes and disrupt the site’s availability. This flaw is a limit or exception error (CWE‑409), leading to a denial of service when an archive is extracted via the Archiver::create('zip') path.

Affected Systems

The vulnerability affects the Grav file‑based web platform from the getgrav:grav vendor. Prior to version 2.0.1, any Grav installation that uses the ZipArchiver::extract() routine is susceptible. Version 2.0.1 and later integrate extraction limits and are not affected.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. No EPSS value is reported, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is supplying a malicious ZIP archive to an endpoint that processes archives via Archiver::create('zip'), as inferred from the description. Success requires only that the archive be processed on the same system, making the attack local but still usable remotely if the site accepts user‑supplied archives. The lack of limits enables resource exhaustion, but no code execution or privilege escalation is possible.

Generated by OpenCVE AI on August 19, 2026 at 17:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Grav 2.0.1 patch or later.
  • Enforce strict upload limits for ZIP files, such as size, file count, and depth, to mitigate potential resource exhaustion.
  • Remove or disable the use of Archiver::create('zip') when handling user‑supplied archives, or replace it with a verified library that enforces limits.

Generated by OpenCVE AI on August 19, 2026 at 17:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Getgrav
Getgrav grav
Vendors & Products Getgrav
Getgrav grav

Wed, 19 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.
Title Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Weaknesses CWE-409
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Getgrav Grav
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-19T15:20:10.966Z

Reserved: 2026-07-10T18:36:58.850Z

Link: CVE-2026-61690

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T16:18:16.867

Modified: 2026-08-19T16:18:16.867

Link: CVE-2026-61690

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T17:45:03Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)