Executive brief
Grav's ZipArchiver class extracts ZIP files without enforcing limits on uncompressed size, file count, or directory nesting depth. An attacker can upload a specially crafted ZIP file ("zip bomb") that decompresses to fill available disk space, causing the web server to become unavailable if the extraction directory shares a partition with the website. While a parallel extraction method was previously patched, this separate code path remains vulnerable to the same attack.
Technical details
The vulnerability exists in ZipArchiver::extract() (system/src/Grav/Common/Filesystem/ZipArchiver.php:29-58), which validates only for path traversal (Zip Slip) before calling ZipArchive::extractTo(). The method fails to enforce three critical limits: maximum uncompressed size (should be 1 GiB), maximum file count (should be 50,000), and maximum directory nesting depth (should be 48 levels). A parallel method, Installer::unZip(), was previously patched (GHSA-2vcx-h8p2-9pg9) with comprehensive validation, but ZipArchiver::extract() remains unprotected. An attacker with the ability to trigger ZIP extraction through third-party plugins or custom code can supply a decompression bomb (highly-compressed data expanding to gigabytes), exhausting disk resources and causing service denial. The vulnerability is reachable via the public Archiver::create('zip') factory, making it accessible to plugin developers and custom code paths. Patch status: Grav 2.0.1 includes the required limits.
Affected products
- getgrav Grav < 2.0.1
Timeline
- 2026-06-24: disclosed: Advisory published to GitHub Advisory Database
- 2026-08-19: advisory: Published to NVD
- 2026-09-02: patched: Grav 2.0.1 released with fix