CVE-2026-61455 Details
Description
Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.
A decompression bomb vulnerability has been identified in Grav versions prior to 2.0.1. The issue resides in the ZipArchiver::extract() method, which lacks restrictions on uncompressed size, file count, and nesting depth. This oversight allows attackers to submit a specially crafted ZIP archive that expands to consume all available disk space, leading to a denial-of-service condition by depleting storage resources. Notably, while the Installer::unZip() method has been fortified with appropriate limits, the ZipArchiver::extract() method remains exposed, creating a separate but similar vulnerability within the same codebase.
To address this vulnerability, the same validation limits applied in the Installer::unZip() method should be incorporated into the ZipArchiver::extract() method. This includes checks for maximum uncompressed size, file count, and nesting depth before extraction.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-before-decompression-bomb-via-ziparchiver | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 0, < 2.0.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |