CVE-2026-61449
CVE-2026-61449 · Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
grav
- Versions
- ≥ 0, < 2.0.2: Affected (semver)
- 2.0.2: Not affected (semver)
Update to 2.0.2
getgrav/grav Packagist
- Versions
- 2.0.1
- Affected ranges
- ECOSYSTEM: ≥ 2.0.1, < 2.0.2
Update to 2.0.2