Executive brief
Grav is a flat-file content management system used to build and manage websites. A vulnerability in Grav 2.0.1's ZIP file extraction feature allows an attacker with administrative upload privileges to craft a malicious ZIP archive that bypasses disk-space limits, causing the extraction process to fill the server's disk or exhaust available inodes, leading to service outage and denial of access for legitimate users.
Technical details
The vulnerability is a data amplification attack (CWE-409) in Grav's ZIP extraction code. ZipArchiver::extract() and GPM\Installer::unZip() validate archive size by summing ZipArchive::statIndex()['size'] values from the ZIP central directory before calling extractTo(). The declared uncompressed size is attacker-controllable and is not validated against the actual inflated stream during extraction. An attacker can forge the central-directory size fields to declare 1 byte per entry while the real compressed content decompresses to gigabytes, bypassing the system.gpm.archive.max_uncompressed_size limit (default 1 GiB). The entry-count and nesting-depth caps remain effective. Attack requires administrative trust (package source or admin backup upload). The fix in 2.0.2 implements stream-based counting or incremental on-disk byte validation to enforce the size limit during extraction rather than relying on declared sizes.
Affected products
- getgrav Grav 2.0.1
Timeline
- 2026-06-25: disclosed: GHSA-8h9x-89f2-m7x3 published (primary advisory)
- 2026-07-15: disclosed: GHSA-v626-428r-43p8 published (duplicate)
- 2026-07-15: patched: CVE-2026-61449 assigned; fix in Grav 2.0.2
- 2026-09-17: other: GHSA-v626-428r-43p8 withdrawn as duplicate of GHSA-8h9x-89f2-m7x3