CVE-2026-61690
Received Received - Intake

Zip Archive Extraction Flaw in Grav CMS

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-61690
EUVD
EUVD-2026-62534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav 2.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a decompression bomb flaw in Grav CMS versions prior to 2.0.1. The ZipArchiver::extract() function does not enforce limits on archive size, file count, or directory nesting depth when extracting ZIP files. Attackers can craft malicious archives that expand to consume excessive disk space or inodes, causing denial of service by making the site unavailable.

Detection Guidance

Check Grav version with: grep -r "version" /path/to/grav/system/defines.php. If version is below 2.0.1, the system is vulnerable. Monitor disk usage and inode exhaustion during ZIP extraction operations. Look for unusually large or deeply nested ZIP archives in upload directories.

Impact Analysis

An attacker could upload a small ZIP file that expands to a very large size when extracted, filling up disk space or exhausting inodes on the server. This would make the site unavailable due to lack of storage or system resources. The vulnerability is accessible via the Archiver::create('zip') factory, which could be triggered by third-party plugins or custom code even if Grav itself does not use it directly.

Compliance Impact

This vulnerability could lead to denial of service by exhausting disk space or inodes, potentially causing system unavailability. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could disrupt access to protected health information systems. Both standards require maintaining availability of critical systems.

Mitigation Strategies

Upgrade Grav to version 2.0.1 or later immediately. If upgrading is not possible, implement manual limits during ZIP extraction: enforce max uncompressed size (1 GiB), max file count (50,000), and max directory depth (48). Block oversized or deeply nested ZIP files at the web server or firewall level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61690. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart