CVE-2026-61449

Name of the Vulnerable Software and Affected Versions Grav version 2.0.1

Description A decompression-bomb size-cap bypass exists in ZipArchiver and GPMInstaller. The system calculates the uncompressed size by summing the values declared in each entry's ZIP central-directory header via ZipArchive::statIndex()['size'] and compares this against system.gpm.archive.max uncompressed size before extraction. Since the declared size can be forged and is not verified against the actual inflated stream, a specially crafted archive with small declared per-entry sizes can bypass the limit. When extractTo() is called, the actual larger content is written, which can lead to disk exhaustion or inode depletion. This requires the archive to be provided by a package source or an administrator upload.

Recommendations Update Grav to version 2.0.2.