CVE-2026-61449
CVE-2026-61449 · Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.
CVSS 7.1 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
grav
- Versiones
- ≥ 0, < 2.0.2: Afectada (semver)
- 2.0.2: No afectada (semver)
Actualiza a 2.0.2
getgrav/grav Packagist
- Versiones
- 2.0.1
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 2.0.1, < 2.0.2
Actualiza a 2.0.2