CVE-2026-61690 in Grav
Summary
by MITRE • 08/19/2026
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Grav versions prior to 2.0.1 represents a critical resource exhaustion flaw within its file-based web platform architecture, specifically located in the ZipArchiver component found at system/src/Grav/Common/Filesystem/ZipArchiver.php. This module is responsible for handling archive extraction operations, which are frequently utilized during package management and content deployment processes. The core technical deficiency lies in the implementation of the extract() method, which delegates file decompression tasks to PHP's native ZipArchive::extractTo function without implementing any pre-validation or runtime constraints on the incoming archive structure. By failing to enforce limits regarding uncompressed size, total file count, or directory nesting depth, the application allows an attacker-controlled archive to bypass standard resource safeguards that are typically enforced by system configuration parameters such as system.gpm.archive settings.
From a technical perspective, this lack of input validation creates a direct pathway for Denial of Service attacks through disk space exhaustion and inode depletion. When an attacker uploads or triggers the extraction of a maliciously crafted zip file designed to contain thousands of tiny files or deeply nested directories that expand into massive uncompressed sizes upon decompression, the server's storage resources are rapidly consumed. Unlike traditional buffer overflow vulnerabilities that target memory integrity, this flaw targets system availability by saturating disk inodes and block space. The operational impact is severe for hosting environments where multiple Grav instances share underlying filesystem resources; a single successful exploitation can render not only the targeted site but potentially adjacent services on the same server unavailable due to resource starvation.
This vulnerability aligns with CWE-409, which describes Improper Handling of Highly Compressed Data in the Input Decoder, as well as CWE-770, Allocation of Resources Without Limits or Throttling. In terms of offensive security frameworks, this flaw maps directly to MITRE ATT&CK technique T1496, Resource Hijacking, where attackers leverage system resources for denial-of-service purposes rather than data exfiltration or persistence. The attack vector typically involves the exploitation of features that accept user-uploaded archives, such as plugin installation interfaces or content import tools, allowing remote unauthenticated or authenticated users to trigger the resource exhaustion depending on the specific access controls in place within their Grav deployment.
Mitigation strategies primarily involve upgrading to version 2.0.1 or later, where the developers have implemented strict validation checks for archive properties before extraction begins. For environments that cannot immediately upgrade, administrators should enforce stricter limits at the web server level by configuring PHP's zip extension settings and adjusting system-level inode quotas. Additionally, implementing file upload size restrictions and monitoring disk usage alerts can provide early warning signs of such attacks. It is also advisable to review any custom code or plugins that utilize the ZipArchiver class to ensure they do not bypass these newly enforced limits if upgrading is delayed.