CVE-2026-61690: Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Grav versions prior to 2.0.1 are affected where application code uses Archiver::create('zip') to extract an attacker-controlled ZIP archive. The impact is denial of service through exhaustion of disk space or filesystem inodes.
What access does an attacker need to exploit this issue?
An attacker needs a way to supply a ZIP archive that the affected Grav instance will extract through the ZIP archiver. The supplied severity vector indicates low privileges are required and no user interaction is needed.
Are default archive extraction limits sufficient in affected versions?
No. Before 2.0.1, ZipArchiver::extract() passes archives to ZipArchive::extractTo() without enforcing configured system.gpm.archive limits for uncompressed size, file count, or nesting depth.
What is the remediation?
Upgrade Grav to version 2.0.1, which fixes the missing extraction-limit enforcement. Until upgrading, avoid extracting attacker-controlled ZIP archives through Archiver::create('zip').