PT-2026-57198

CVE-2026-61455

Published

2026-07-10

Updated

2026-09-02

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.1

Description A decompression bomb issue exists in the ZipArchiver::extract() function. The function does not impose limits on the number of files, nesting depth, or the total uncompressed size of archives. An attacker can provide a specially crafted ZIP archive that expands to consume all available disk space, resulting in a denial of service by exhausting storage resources.

Recommendations Update Grav to version 2.0.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alienkeric

Vendors

Affected products

Weakness enumeration

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Related identifiers