CVE-2026-59193
published 2026-07-10CVE-2026-59193: Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP…
PriorityP427medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
0.60%
48.1th percentile
Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | — | — |
| getgrav | grav | — | — |
| getgrav | grav | >= 1.0.0 < 2.0.0 | 2.0.0 |
| getgrav | grav | >= 1.0.0 < 2.0.0 | 2.0.0 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
getgrav Grav up to 1.x ZIP Archive extractTo denial of service (EUVD-2026-42951)
vuldb·2026-09-17·CVSS 4.9
CVE-2026-59193 [MEDIUM] getgrav Grav up to 1.x ZIP Archive extractTo denial of service (EUVD-2026-42951)
A vulnerability identified as problematic has been detected in getgrav Grav up to 1.x. This affects the function extractTo of the component ZIP Archive Handler. The manipulation leads to denial of service.
This vulnerability is documented as CVE-2026-59193. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
ghsa·2026-09-16·CVSS 9.1
CVE-2026-59193 [CRITICAL] CWE-409 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
### Summary
An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method `Installer::unZip()` calls `ZipArchive::extractTo()` without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bomb (CWE-409), stack overflow (CWE-674), and disk/inode exhaustion.
### Details
The vulnerability is in `system/src/Grav/Common/GPM/Installer.php:176-208` (`Installer::unZip()`). The `ZipArchive::extractTo()` call at line 184 is not preceded by any validation of the archive contents.
Missing validation:
- ❌ No total uncompressed size check (decompression bomb — CWE-409)
- ❌ No entry count check (inode exhaustio
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-10
Published