CVE-2026-61690: Grav ZipArchiver decompression bomb via missing extraction limits

CVE-2026-61690 · Severity: medium · CVSS 6.5 · Published 2026-09-02

Grav's ZipArchiver class extracts ZIP files without enforcing limits on uncompressed size, file count, or directory nesting depth. An attacker can upload a specially crafted ZIP file ("zip bomb") that decompresses to fill available disk space, causing the web server to become unavailable if the extraction directory shares a partition with the website. While a parallel extraction method was previously patched, this separate code path remains vulnerable to the same attack.

Technologies: getgrav/grav (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-61690 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61690 being exploited in the wild.
How severe is CVE-2026-61690?
Medium severity, with a CVSS score of 6.5, published 2 September 2026.
Which products and versions are affected?
getgrav/grav (Packagist) < 2.0.1.
Is there a fix for CVE-2026-61690?
A patch was published on 2026-09-02: Grav 2.0.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61690 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-61690?
Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in ZipArchiver::extract() (system/src/Grav/Common/Filesystem/ZipArchiver.php:29-58), which validates only for path traversal (Zip Slip) before calling ZipArchive::extractTo(). The method fails to enforce three critical limits: maximum uncompressed size (should be 1 GiB), maximum file count (should be 50,000), and maximum directory nesting depth (should be 48 levels). A parallel method, Installer::unZip(), was previously patched (GHSA-2vcx-h8p2-9pg9) with comprehensive validation, but ZipArchiver::extract() remains unprotected. An attacker with the ability to trigger ZIP extraction through third-party plugins or custom code can supply a decompression bomb (highly-compressed data expanding to gigabytes), exhausting disk resources and causing service denial. The vulnerability is reachable via the public Archiver::create('zip') factory, making it accessible to plugin developers and custom code paths. Patch status: Grav 2.0.1 includes the required limits.

Affected products

  • getgrav Grav < 2.0.1

Identifiers

  • CVE-2026-61690
  • GHSA-928x-9mpw-8h56

Timeline

  • 2026-06-24: disclosed: Advisory published to GitHub Advisory Database
  • 2026-08-19: advisory: Published to NVD
  • 2026-09-02: patched: Grav 2.0.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.