CVE-2026-61449: Grav CMS Decompression Bomb DOS Vulnerability

CVE-2026-61449 Overview

CVE-2026-61449 is a decompression-bomb size-cap bypass affecting Grav CMS version 2.0.1. The flaw resides in the ZipArchiver and GPM\Installer components, where the size limit introduced in 2.0.1 relies on the uncompressed size declared in each entry's ZIP central-directory header. Because attackers can forge these declared values, a crafted archive can pass the system.gpm.archive.max_uncompressed_size check while extractTo() writes far larger content to disk. Successful exploitation fills disk space or exhausts inodes, resulting in denial of service. The issue is fixed in Grav 2.0.2 and represents an incomplete fix for GHSA-928x-9mpw-8h56.

Critical Impact
Attackers with package source or admin upload trust can exhaust disk space or inodes on Grav servers using forged ZIP metadata, disrupting availability [CWE-409].

Affected Products

Grav CMS 2.0.1
Grav ZipArchiver component
Grav GPM\Installer package installer

Discovery Timeline

2026-07-15 - CVE-2026-61449 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61449

Vulnerability Analysis

Grav 2.0.1 introduced a size cap intended to prevent decompression bombs during package installation. The check iterates over ZIP entries and sums the uncompressed size reported by ZipArchive::statIndex()['size'] for each entry. If the total exceeds system.gpm.archive.max_uncompressed_size, the archive is rejected before extraction. The vulnerability stems from trusting attacker-controllable metadata as an authoritative measurement.

The declared size lives in the ZIP central-directory header, which any attacker can forge. Grav never cross-checks the declared value against the actual inflated stream length. A crafted archive can advertise trivial per-entry sizes while carrying entries that inflate to gigabytes. When extractTo() runs, the real, much larger content is written to disk.

Root Cause

The root cause is a validation gap classified under [CWE-409] (Improper Handling of Highly Compressed Data). The size-cap logic uses self-reported metadata rather than measuring inflated output during extraction. No streaming size counter enforces the cap while data is being written.

Attack Vector

Exploitation requires an attacker to supply a malicious ZIP through a trusted channel: a configured package source or an admin/operator upload path. The attacker crafts a ZIP whose central-directory entries declare small size values but whose compressed streams inflate to arbitrary volumes. When an operator triggers installation, Grav's pre-flight sum passes, and extractTo() writes the oversized payload, filling the filesystem or exhausting inodes. The vulnerability manifests in the GPM installer path. Refer to the GitHub Security Advisory and the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-61449

Indicators of Compromise

Sudden disk-space exhaustion or inode exhaustion on Grav web servers shortly after a plugin, theme, or package installation event.
Grav log entries showing successful GPM\Installer extraction followed by filesystem write errors or service failures.
Presence of unusually large files in Grav's cache, tmp, or extraction working directories after package install.

Detection Strategies

Compare declared uncompressed sizes against actual on-disk sizes of extracted files from recent GPM installations to spot ratio anomalies.
Alert on any Grav admin upload of ZIP archives whose extracted payload exceeds a defined multiple of the declared size.
Monitor Grav version banners across the estate and flag hosts still running 2.0.1 or earlier.

Monitoring Recommendations

Track filesystem utilization and inode counts on Grav-hosting volumes with thresholds tuned to trigger before saturation.
Enable audit logging on admin panel uploads and GPM install actions and forward events to a central SIEM for correlation.
Review package source configurations regularly to ensure only trusted repositories are permitted.

How to Mitigate CVE-2026-61449

Immediate Actions Required

Upgrade Grav to version 2.0.2 or later on all instances without delay.
Restrict admin panel access and package upload permissions to a minimal set of trusted operators.
Audit configured GPM package sources and remove any untrusted or unnecessary repositories.

Patch Information

Grav 2.0.2 addresses CVE-2026-61449 by correcting the size-cap logic in ZipArchiver and GPM\Installer. Administrators should apply the upstream release published in the GitHub Security Advisory GHSA-8h9x-89f2-m7x3. This release supersedes the incomplete fix originally shipped as GHSA-928x-9mpw-8h56.

Workarounds

Disable admin uploads of ZIP archives until the 2.0.2 upgrade is applied.
Enforce filesystem quotas on the account running the Grav process to bound the impact of a successful decompression bomb.
Place Grav's writable directories on a dedicated volume so exhaustion cannot affect other services on the host.

bash

# Verify Grav version and upgrade via CLI
bin/grav --version
bin/gpm selfupgrade
bin/grav --version