Executive brief
Grav CMS is a flat-file content management system used to publish websites. An authenticated administrator can upload a maliciously crafted ZIP archive through the Direct Install tool, causing the server to extract extremely compressed files without size limits, resulting in disk exhaustion, inode depletion, and service disruption affecting all users. The vulnerability also allows the cleanup process to fail silently due to PHP stack overflow on deeply nested directories, leaving extracted files permanently on disk.
Technical details
The vulnerability resides in system/src/Grav/Common/GPM/Installer.php:176-208 (Installer::unZip()). The method directly calls ZipArchive::extractTo() without preceding validation of archive contents, missing critical checks for: total uncompressed file size (decompression bomb); entry count (inode exhaustion); and directory nesting depth (PHP stack overflow in recursive cleanup). The subsequent Folder::delete() call recursively deletes subdirectories without depth limits, causing PHP's maximum nesting level to be exceeded with deeply nested archives, leaving extracted files on disk permanently. The existing Zip Slip fix (CVE-2026-42607) only validates for ../ path traversal and does not add size, count, or depth protections. A proof-of-concept achieves ~196:1 compression ratios with simple repeating data and can create arbitrarily deep nesting structures. Patch available in version 2.0.0.
Affected products
- Grav Grav CMS >= 1.0.0, < 2.0.0
Timeline
- 2026-09-16: disclosed: Published to GitHub Advisory Database
- 2026-06-22: patched: Fix released in version 2.0.0