CVE-2026-61455 Overview
CVE-2026-61455 is a decompression bomb vulnerability in Grav, an open-source flat-file content management system (CMS). Versions before 2.0.1 contain flawed logic in the ZipArchiver::extract() function that fails to enforce limits on uncompressed size, file count, or archive nesting depth. Authenticated attackers can upload a crafted ZIP archive that expands to consume all available disk space. The resulting resource exhaustion produces a denial-of-service (DoS) condition against the host system. The weakness is tracked as CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).
Critical Impact
A single malicious ZIP upload can exhaust disk storage on a Grav server, disabling the CMS and any co-located services relying on the same volume.
Affected Products
- Grav CMS versions prior to 2.0.1
- Grav installations exposing authenticated ZIP archive extraction functionality
- Any deployment using the vulnerable ZipArchiver::extract() method
Discovery Timeline
- 2026-07-10 - CVE-2026-61455 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-61455
Vulnerability Analysis
Grav's ZipArchiver::extract() method processes ZIP archives without validating the resource footprint of the decompressed content. ZIP compression can achieve ratios exceeding 1000:1 using repeated byte patterns. A small archive of a few megabytes can therefore expand to gigabytes or terabytes on disk. Because the extraction routine streams file entries directly to the filesystem, the process consumes storage until the disk fills or the operation is terminated.
The GitHub Security Advisory GHSA-928x-9mpw-8h56 and the VulnCheck Advisory document the missing safeguards.
Root Cause
The root cause is the absence of pre-extraction validation. The function does not inspect the archive's declared uncompressed size, does not cap the total number of extracted entries, and does not restrict recursive archive nesting. These missing controls allow a decompression bomb to bypass all resource boundaries.
Attack Vector
An attacker with low privileges authenticates to a Grav instance and uploads a crafted ZIP file through a feature that invokes ZipArchiver::extract(). The attack requires no user interaction beyond the attacker's own upload action. Once extraction begins, disk consumption grows rapidly, degrading or halting the CMS and any dependent services. The vulnerability affects availability only; confidentiality and integrity are not directly impacted.
Refer to the linked vendor advisory for technical details on the vulnerable code path.
Detection Methods for CVE-2026-61455
Indicators of Compromise
- Sudden spikes in disk utilization on Grav web servers coinciding with authenticated file upload events
- Presence of unusually large extracted directories under Grav user data or plugin installation paths
- ZIP files in upload logs with abnormally high compression ratios (small archive, massive declared uncompressed size)
- Application errors or service outages caused by ENOSPC (no space left on device) conditions
Detection Strategies
- Inspect web server access logs for POST requests to Grav administrative endpoints handling archive uploads by low-privilege accounts
- Correlate authenticated upload events with filesystem growth telemetry to identify decompression bomb activity
- Scan archives before extraction to compare declared uncompressed size against a maximum threshold
Monitoring Recommendations
- Enable filesystem quota monitoring on volumes hosting Grav content and alert on rapid consumption
- Log every invocation of ZipArchiver::extract() with the source archive size, entry count, and extracted byte total
- Monitor Grav audit logs for archive uploads from newly created or rarely used accounts
How to Mitigate CVE-2026-61455
Immediate Actions Required
- Upgrade Grav to version 2.0.1 or later, which enforces limits on uncompressed size, file count, and nesting depth
- Audit existing Grav user accounts and remove or restrict low-privilege accounts that are not required
- Review recent uploads for oversized extracted directories and remove any suspicious archives
- Verify filesystem free space and restore disk capacity on any affected servers
Patch Information
The Grav maintainers released version 2.0.1 to address CVE-2026-61455. The fix adds pre-extraction checks in ZipArchiver::extract() for total uncompressed size, entry count, and nesting depth. Administrators should consult the GitHub Security Advisory GHSA-928x-9mpw-8h56 for upgrade guidance.
Workarounds
- Restrict archive upload capabilities to trusted administrator accounts until patching is complete
- Apply operating system disk quotas to the Grav process account to cap maximum storage consumption
- Place Grav behind a web application firewall (WAF) rule that blocks ZIP uploads exceeding a defined size or ratio threshold
- Isolate the Grav data volume from critical system partitions to contain the impact of resource exhaustion
# Configuration example: apply a filesystem quota to the Grav service account
sudo setquota -u www-data 5242880 5242880 0 0 /var/www
# Verify the quota was applied
sudo quota -u www-data
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
