# CVE-2026-61690: Grav ZipArchiver decompression bomb via missing extraction limits

Source: https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61690 · Severity: medium · CVSS 6.5 · Published 2026-09-02

Grav's ZipArchiver class extracts ZIP files without enforcing limits on uncompressed size, file count, or directory nesting depth. An attacker can upload a specially crafted ZIP file ("zip bomb") that decompresses to fill available disk space, causing the web server to become unavailable if the extraction directory shares a partition with the website. While a parallel extraction method was previously patched, this separate code path remains vulnerable to the same attack.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-61690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61690 being exploited in the wild.

**How severe is CVE-2026-61690?** Medium severity, with a CVSS score of 6.5, published 2 September 2026.

**Which products and versions are affected?** getgrav/grav (Packagist) < 2.0.1.

**Is there a fix for CVE-2026-61690?** A patch was published on 2026-09-02: Grav 2.0.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61690 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61690?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in ZipArchiver::extract() (system/src/Grav/Common/Filesystem/ZipArchiver.php:29-58), which validates only for path traversal (Zip Slip) before calling ZipArchive::extractTo(). The method fails to enforce three critical limits: maximum uncompressed size (should be 1 GiB), maximum file count (should be 50,000), and maximum directory nesting depth (should be 48 levels). A parallel method, Installer::unZip(), was previously patched (GHSA-2vcx-h8p2-9pg9) with comprehensive validation, but ZipArchiver::extract() remains unprotected. An attacker with the ability to trigger ZIP extraction through third-party plugins or custom code can supply a decompression bomb (highly-compressed data expanding to gigabytes), exhausting disk resources and causing service denial. The vulnerability is reachable via the public Archiver::create('zip') factory, making it accessible to plugin developers and custom code paths. Patch status: Grav 2.0.1 includes the required limits.

## Affected products

- getgrav Grav < 2.0.1

## Identifiers

- CVE-2026-61690
- GHSA-928x-9mpw-8h56

## Timeline

- 2026-06-24: disclosed: Advisory published to GitHub Advisory Database
- 2026-08-19: advisory: Published to NVD
- 2026-09-02: patched: Grav 2.0.1 released with fix

## References

- [https://api.github.com/users/alienkeric](https://api.github.com/users/alienkeric)
- [https://github.com/alienkeric](https://github.com/alienkeric)
- [https://api.github.com/users/alienkeric/gists%7B/gist_id%7D](https://api.github.com/users/alienkeric/gists%7B/gist_id%7D)
- [https://api.github.com/users/alienkeric/repos](https://api.github.com/users/alienkeric/repos)
- [https://avatars.githubusercontent.com/u/102582785?v=4](https://avatars.githubusercontent.com/u/102582785?v=4)
- [https://api.github.com/users/alienkeric/events%7B/privacy%7D](https://api.github.com/users/alienkeric/events%7B/privacy%7D)

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)
- [Grav CMS origin validation bypass in referrer header](https://junglewise.ai/threats/grav-cms-origin-validation-bypass-in-referrer-header-0f775642)