CVE-2026-59193: Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59193?
CVE-2026-59193 has a medium severity rating of 6.9 based on the CVSS scoring system.
How do I fix CVE-2026-59193?
To fix CVE-2026-59193, you should update to Grav CMS version 2.0.0 or later where the vulnerability is patched.
What type of vulnerability is CVE-2026-59193?
CVE-2026-59193 is classified as an improper handling of highly compressed data issue in the Grav CMS.
Who is affected by CVE-2026-59193?
Authenticated admin.super users of Grav CMS prior to version 2.0.0 are affected by CVE-2026-59193.
What can happen if CVE-2026-59193 is exploited?
If exploited, CVE-2026-59193 can cause Grav CMS to crash or fill the server's disk space by uploading malicious ZIP archives.