# CVE-2026-61449: Grav decompression bomb size-cap bypass in ZipArchiver

Source: https://junglewise.ai/threats/cve-2026-61449-grav-decompression-bomb-size-cap-bypass-in-ziparchiver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61449 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Grav is a flat-file CMS used to build websites without a database. When administrators install packages, restore backups, or upgrade the system, Grav extracts ZIP archives. A malicious or compromised ZIP can declare tiny file sizes while actually containing massive amounts of data, bypassing Grav's safeguard against decompression bombs. This causes the server's disk to fill up completely, shutting down the website and wasting storage resources. While currently limited to admin-level actors with upload/install privileges, the vulnerability completely defeats a critical resource-exhaustion protection.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-61449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61449 being exploited in the wild.

**How severe is CVE-2026-61449?** Medium severity, with a CVSS score of 6.5, published 15 July 2026.

**Which products and versions are affected?** Grav >= 2.0.1, < 2.0.2; getgrav/grav (Packagist) = 2.0.1, ECOSYSTEM:introduced=2.0.1,fixed=2.0.2.

**Is there a fix for CVE-2026-61449?** Yes. getgrav/grav (Packagist): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61449 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61449?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.2 or later

  ```sh
  composer require getgrav/grav:^2.0.2
  ```


## Technical details

The vulnerability is a decompression-bomb bypass in ZIP extraction logic (`ZipArchiver.php:77–86` and `Installer.php:228–238`). Both code paths validate archive size by summing `ZipArchive::statIndex($i)['size']`, which reads uncompressed sizes declared in the ZIP central directory. This value is attacker-forgeable; libzip's `extractTo()` does not cross-check declared vs. actual inflated stream size during extraction. An attacker crafts a 10 KiB deflate-compressed ZIP containing 10 MiB of zeros, then patches both the local and central directory size fields to `1`, causing the pre-extraction validation to report total size of 1 byte (passing the cap) while `extractTo()` writes the actual 10 MiB to disk. Reachable via `GPM\Installer::unZip` (package install, direct-install, self-upgrade) and `ZipArchiver::extract` (admin backup restore). The fix is to track cumulative written bytes during stream extraction, not pre-validated declared sizes. Patched in version 2.0.2.

## Affected products

- Getgrav Grav 2.0.1

## Identifiers

- CVE-2026-61449
- GHSA-8h9x-89f2-m7x3

## Timeline

- 2026-06-25: disclosed: Published to GitHub Advisory Database
- 2026-09-17: advisory: Updated on GitHub Advisory Database
- 2026-: patched: Fixed in version 2.0.2

## References

- [https://api.github.com/users/iliaal](https://api.github.com/users/iliaal)
- [https://github.com/iliaal](https://github.com/iliaal)
- [https://api.github.com/users/iliaal/gists%7B/gist_id%7D](https://api.github.com/users/iliaal/gists%7B/gist_id%7D)
- [https://api.github.com/users/iliaal/repos](https://api.github.com/users/iliaal/repos)
- [https://avatars.githubusercontent.com/u/158724?v=4](https://avatars.githubusercontent.com/u/158724?v=4)
- [https://api.github.com/users/iliaal/events%7B/privacy%7D](https://api.github.com/users/iliaal/events%7B/privacy%7D)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)