CVE-2026-61449
CVE-2026-61449 · Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.
CVSS 7.1 · Hoch · EPSS 0,3% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
grav
- Softwareversionen
- ≥ 0, < 2.0.2: Betroffen (semver)
- 2.0.2: Nicht betroffen (semver)
Auf 2.0.2 aktualisieren
getgrav/grav Packagist
- Softwareversionen
- 2.0.1
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 2.0.1, < 2.0.2
Auf 2.0.2 aktualisieren