CVE-2026-59193 Details
Description
Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.
A vulnerability in Grav CMS versions 1.0.0 prior to 2.0.0, excluding 2.0.0-beta.2, allows authenticated admin.super users to upload malicious ZIP files via the Direct Install tool. The 'Installer::unZip' method extracts these files without any restrictions on uncompressed size, file count, or directory depth. This oversight can lead to a 'Zip Bomb' effect, filling the disk with data, exhausting inodes, or causing a stack overflow by creating deeply nested directories. The issue has been addressed in Grav version 2.0.0.
Users can update to Grav version 2.0.0, where this vulnerability has been fixed. Instructions for updating can be found in the Grav documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781 | [email protected] | Patch |
| https://github.com/getgrav/grav/releases/tag/2.0.0 | [email protected] | Product |
| https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getgrav grav | >= 1.0.0, < 2.0.0 2.0.0 beta1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | New CVE Received | [email protected] |