CVE-2026-59193: Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct

mediumCVSS 4.9CVE-2026-59193

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4.9
Published: 2026-07-10
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59193

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59193	coverage & exploitation status	NVD · CVE.org

Recent advisories for Grav is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-59190: grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create a…nvd · 2026-07-10
unknownCVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call bui…nvd · 2026-07-10
unknownCVE-2026-58492: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists…nvd · 2026-07-10
mediumCVE-2026-55890: Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS t…nvd · 2026-07-10
mediumCVE-2026-55885: Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup…nvd · 2026-07-10
unknownCVE-2026-53653: Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthentica…nvd · 2026-07-10

CVE-2026-59193: Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct

Details

Referenced CVEs

Recent advisories for Grav is a

More from NVD Recent CVEs