CVE-2026-61455: Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply

mediumCVSS 6.5CVE-2026-61455

Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 6.5
Published: 2026-07-10
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-61455

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-61455	coverage & exploitation status	NVD · CVE.org

Recent advisories for Grav

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-59193: Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash…nvd · 2026-07-10
unknownCVE-2026-59190: grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create a…nvd · 2026-07-10
unknownCVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call bui…nvd · 2026-07-10
unknownCVE-2026-58492: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists…nvd · 2026-07-10
mediumCVE-2026-55890: Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS t…nvd · 2026-07-10
mediumCVE-2026-55885: Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup…nvd · 2026-07-10

CVE-2026-61455: Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply

Details

Referenced CVEs

Recent advisories for Grav

More from NVD Recent CVEs