CVE-2026-61690

MediumCVSS 6.5

Published: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

Grav prior to 2.0.1 in ZipArchiver::extract() passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable.

Risk Assessment

An attacker can cause exhaustion of system resources, leading to denial of service and site unavailability.

Recommendation

Update Grav to version 2.0.1 or later and restrict archive extraction to trusted sources.

Original NVD description (English source)

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.