CVE-2026-61449: Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.maxuncompressedsize before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.2 - Configuration
Use the decompression-bomb size-cap introduced in v2.0.1: sum the uncompressed sizes declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and reject archives exceeding system.gpm.archive.max_uncompressed_size before extraction.
Grav GPM system.gpm.archive.max_uncompressed_size = (enforce/keep the size bound introduced in 2.0.1) - Compensating control
Ensure archives are supplied only by a trusted package source or admin upload (admin/operator trust) since the decompression-bomb size-cap bypass exists in Grav 2.0.1 (ZipArchiver and GPM\Installer).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61449?
The severity of CVE-2026-61449 is rated high with a score of 7.1.
What is CVE-2026-61449?
CVE-2026-61449 refers to a decompression-bomb size-cap bypass vulnerability in Grav versions prior to 2.0.2.
How do I fix CVE-2026-61449?
To fix CVE-2026-61449, upgrade your Grav installation to version 2.0.2 or later.
What are the potential impacts of CVE-2026-61449?
The potential impact of CVE-2026-61449 includes denial of service due to system resource exhaustion.
Which versions of Grav are affected by CVE-2026-61449?
CVE-2026-61449 affects Grav versions 2.0.1 and earlier.