CVE-2026-59193: Getgrav Grav DOS Vulnerability

CVE-2026-59193 Overview

CVE-2026-59193 is a denial of service vulnerability in Grav, a file-based Web platform. The flaw resides in the Installer::unZip function, which invokes ZipArchive::extractTo without enforcing limits on uncompressed size, entry count, or directory depth. An authenticated admin.super user can upload a specially crafted ZIP archive through the Direct Install tool to crash Grav or exhaust disk space on the underlying host. The vulnerability is tracked under [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)]. It affects all Grav versions prior to 2.0.0 and is fixed in version 2.0.0.

Critical Impact
An authenticated administrator can trigger a decompression bomb, inode exhaustion, or excessive directory nesting, crashing the Grav application or filling the underlying disk.

Affected Products

Getgrav Grav versions prior to 2.0.0
Getgrav Grav 2.0.0-beta1
Grav Admin plugin Direct Install tool

Discovery Timeline

2026-07-10 - CVE-2026-59193 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-59193

Vulnerability Analysis

Grav's Direct Install feature allows administrators to install plugins, themes, and core updates from ZIP archives. The archive extraction path in system/src/Grav/Common/GPM/Installer.php calls ZipArchive::extractTo directly. This PHP function performs no validation of the archive's decompressed footprint. A small compressed archive can expand to gigabytes on disk or contain millions of empty entries. Grav writes each entry to the target directory until the disk fills or PHP exhausts memory.

The result is a resource exhaustion condition that can render the Grav instance and, depending on the deployment, the host operating system unresponsive. Exploitation requires authentication as an admin.super user, which limits the vulnerability to insider abuse or scenarios where administrator credentials are compromised.

Root Cause

The root cause is the absence of bounds checking during archive extraction. Installer::unZip did not track cumulative uncompressed size, entry count, or nesting depth. The patch introduces a new error constant ZIP_LIMITS_ERROR = 256 and enforces bounded extraction to reject decompression bombs, inode exhaustion, and excessive nesting.

Attack Vector

An attacker with admin.super privileges navigates to the Direct Install interface and uploads a crafted ZIP archive. The archive contains either a highly compressed payload that expands to exhaust disk space, a large number of small entries designed to exhaust inodes, or deeply nested directories intended to trigger file system limits.

php

// Patch: system/src/Grav/Common/GPM/Installer.php
     public const ZIP_EXTRACT_ERROR = 64;
     /** @const Invalid source file */
     public const INVALID_SOURCE = 128;
+    /** @const Archive exceeds the configured extraction limits (decompression bomb / inode exhaustion / excessive nesting) */
+    public const ZIP_LIMITS_ERROR = 256;

     /** @var string Destination folder on which validation checks are applied */
     protected static $target;

Source: Grav Security Commit 23d6f2a

Detection Methods for CVE-2026-59193

Indicators of Compromise

Sudden disk space exhaustion on the Grav host correlated with an administrator session using the Direct Install feature.
Unusual spikes in file or inode counts under the Grav tmp/ or plugin/theme installation directories.
PHP error logs recording memory exhaustion or timeout errors originating from Installer::unZip.
Repeated failed installation attempts logged by the Grav Admin plugin.

Detection Strategies

Monitor Grav administrator authentication events and cross-correlate with Direct Install file upload activity.
Alert on host-level file system metrics such as free disk space, inode utilization, and rapid directory tree growth under Grav web roots.
Inspect uploaded ZIP archives with pre-processing tools that compute uncompressed-to-compressed ratios before Grav performs extraction.

Monitoring Recommendations

Enable audit logging for the Grav Admin plugin and forward logs to a centralized SIEM for review.
Track process-level resource consumption of the PHP-FPM or web server worker handling admin requests.
Set alerting thresholds on disk and inode utilization on servers hosting Grav.

How to Mitigate CVE-2026-59193

Immediate Actions Required

Upgrade Grav to version 2.0.0 or later, which enforces bounded ZIP extraction limits.
Audit the list of accounts holding the admin.super role and remove unnecessary privileges.
Rotate administrator credentials if any signs of unauthorized access are present.
Review recent Direct Install activity for unexpected uploads.

Patch Information

The vulnerability is fixed in Grav 2.0.0. The fix is implemented in commit 23d6f2adf4ce11889c088ac8557c8314baeef781 and documented in GitHub Security Advisory GHSA-2vcx-h8p2-9pg9. Release notes are available in the Grav 2.0.0 release.

Workarounds

Restrict access to the Direct Install feature by limiting the admin.super role to trusted administrators only.
Place Grav behind a reverse proxy or web application firewall that enforces upload size limits.
Configure operating system disk quotas for the user account running the Grav web server process.
Monitor and manually validate any third-party ZIP archives before installation until the upgrade is complete.

bash

# Restrict PHP upload size and enforce disk quota for the web server user
# php.ini
upload_max_filesize = 32M
post_max_size = 32M
memory_limit = 128M

# Enforce a disk quota (Linux) for the www-data user
sudo setquota -u www-data 5000000 5500000 0 0 /var/www