Grav CMS Decompression Bomb Vulnerability

Executive Summary

CVE-2026-61455 is a decompression bomb vulnerability in Grav CMS versions before 2.0.1. It exists in the ZipArchiver::extract() method, which does not impose limits on the uncompressed size, number of files, or nesting depth when extracting ZIP archives.

An attacker can craft a small ZIP file that, when extracted, expands massively (for example, a 42 KB ZIP expanding to 10 GB), potentially filling up all available disk space.

This can cause a denial of service (DoS) by exhausting storage resources on the affected system.

The vulnerability arises because unlike the Installer::unZip() method, ZipArchiver::extract() lacks protections against such decompression bombs.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability causes a denial-of-service condition by exhausting disk space through decompression bombs, impacting system availability.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, denial of service and resource exhaustion could indirectly affect compliance by disrupting availability requirements in these regulations.

However, there is no direct information provided about how this vulnerability specifically impacts compliance with such standards.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to cause a denial of service on your system.

By supplying a specially crafted ZIP archive, an attacker can cause your system to run out of disk space during extraction, potentially disrupting services or applications relying on Grav CMS.

This exhaustion of storage resources can lead to system instability, crashes, or inability to store new data until the disk space is freed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a decompression bomb in ZIP archives that can cause denial of service by exhausting disk space when extracted. Detection involves monitoring for unusually large disk usage spikes or extraction of suspicious ZIP files that expand disproportionately compared to their compressed size.

Since the vulnerability is triggered by extraction of crafted ZIP files, you can detect potential exploitation attempts by checking for large ZIP files or monitoring extraction operations.

• Use disk usage monitoring commands such as 'df -h' or 'du -sh' on directories where ZIP files are extracted to detect sudden large disk consumption.
• List recently extracted files and their sizes with commands like 'ls -lh' or 'find /path/to/extract -type f -exec ls -lh {} +' to identify unexpectedly large extracted content.
• Check for ZIP files with suspicious compression ratios using tools like 'zipinfo' or '7z l' to analyze archive contents before extraction.
• Monitor application logs or plugin logs that use ZipArchiver::extract() for unusual extraction errors or warnings.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to apply the same archive limits validation used in the safe Installer::unZip() method to the ZipArchiver::extract() method. This includes enforcing limits on uncompressed size, file count, and nesting depth during ZIP extraction.

Since the vulnerable code path is not used by first-party Grav code but may be triggered by third-party plugins or custom code, review and update any plugins or custom code that use ZipArchiver::extract() to include these protections.

Additionally, monitor and restrict the size and content of ZIP files accepted by your system to prevent decompression bombs.

If available, update Grav CMS and any related plugins to versions that include the fix for this vulnerability.

Useful 0 Not Useful 0