CVE-2026-61690 Overview
CVE-2026-61690 is a denial-of-service vulnerability in Grav, a file-based web platform. The flaw exists in ZipArchiver::extract() within system/src/Grav/Common/Filesystem/ZipArchiver.php. The method passes archives directly to ZipArchive::extractTo() without enforcing the configured system.gpm.archive limits for uncompressed size, file count, or nesting depth. An authenticated attacker who supplies a crafted archive to any code path that calls Archiver::create('zip') can exhaust disk space or inodes on the host. The condition renders the site unavailable. Grav 2.0.1 resolves the issue by enforcing the documented archive bounds during extraction.
Critical Impact
Authenticated attackers can upload decompression-bomb archives that exhaust disk space or inodes, making the Grav site unavailable.
Affected Products
- Grav CMS versions prior to 2.0.1
- Grav 2.0.0 (confirmed vulnerable per commit history)
- Any plugin or theme invoking Archiver::create('zip')->extract()
Discovery Timeline
- 2026-08-19 - CVE-2026-61690 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-61690
Vulnerability Analysis
Grav exposes an Archiver factory that returns a ZipArchiver when the target format is zip. The extract() method opens the supplied archive and calls PHP's native ZipArchive::extractTo() on the destination directory. Grav's configuration schema defines system.gpm.archive limits intended to bound the uncompressed size, number of entries, and nesting depth for extracted archives. Prior to 2.0.1, ZipArchiver::extract() never consulted those limits before delegating to ZipArchive::extractTo(). An attacker who can influence any archive processed by this code path — for example, a plugin installation flow, a backup restore, or a user-controlled upload feature — can supply a decompression bomb. The archive expands to fill the target filesystem, exhausting storage bytes or inode counts. The web server, database, and Grav runtime lose the ability to write session files, cache entries, or logs. The vulnerability is classified as [CWE-409] Improper Handling of Highly Compressed Data (Data Amplification).
Root Cause
The root cause is missing enforcement of resource limits during archive extraction. Grav defined system.gpm.archive bounds but the extraction path did not read or apply them. ZipArchive::extractTo() writes every entry regardless of aggregate size, entry count, or path depth. No pre-extraction inspection of the central directory occurs.
Attack Vector
Exploitation requires network access and low-privilege authenticated access to a Grav endpoint that reaches ZipArchiver::extract(). The attacker crafts a ZIP archive with a small compressed footprint that expands to a large uncompressed payload, or that contains an inflated number of small entries to exhaust inodes. Submitting the archive to a plugin installer, theme importer, or restore workflow triggers extraction and consumes host resources until the filesystem is full.
// Patch excerpt: system/src/Grav/Common/Filesystem/ZipArchiver.php (v2.0.1)
namespace Grav\Common\Filesystem;
+use Grav\Common\Grav;
use InvalidArgumentException;
use RuntimeException;
use ZipArchive;
// Source: https://github.com/getgrav/grav/commit/1c1003cfcab5344203d6fde1aaa1f9a4ee3413ff
Detection Methods for CVE-2026-61690
Indicators of Compromise
- Rapid growth in the Grav tmp/, backup/, or user/data/ directories following an authenticated session
- Filesystem or inode exhaustion alerts on the web host correlated with Grav admin activity
- Web server 500 responses or Grav write-failure exceptions in logs/grav.log referencing archive extraction
- Uploaded ZIP files with unusually high compression ratios (for example, output size >100x input size)
Detection Strategies
- Inspect central-directory metadata of uploaded archives and flag archives where the sum of uncompressed sizes exceeds a defined threshold before extraction.
- Monitor process activity for php invocations that trigger sustained write bursts to Grav content directories.
- Alert on file counts under Grav-managed directories that exceed baseline plugin and theme footprints.
Monitoring Recommendations
- Track filesystem usage and inode counts on Grav web hosts with per-mountpoint thresholds.
- Enable and centralize logs/grav.log and web server access logs to a SIEM to correlate archive uploads with disk-pressure events.
- Record authenticated admin actions that invoke plugin installation, theme import, or backup restore endpoints.
How to Mitigate CVE-2026-61690
Immediate Actions Required
- Upgrade Grav to version 2.0.1 or later, which enforces the system.gpm.archive bounds during ZIP extraction.
- Restrict administrative access to Grav to trusted operators until the upgrade completes.
- Review recent uploads and installed plugins for unknown archives and remove suspicious content.
Patch Information
The fix is delivered in Grav 2.0.1. See the GitHub Release 2.0.1, the GitHub Commit Details, and the GitHub Security Advisory GHSA-928x-9mpw-8h56. The patch bumps GRAV_VERSION to 2.0.1 and introduces the Grav\Common\Grav import inside ZipArchiver.php so that the extractor can read the configured archive limits before delegating to ZipArchive::extractTo().
Workarounds
- Apply filesystem quotas to the user account running the PHP process to cap the impact of runaway extraction.
- Place a reverse proxy or WAF rule that rejects uploaded ZIP files above a strict size limit for Grav admin endpoints.
- Disable or gate plugin installation and backup-restore features for non-administrator roles.
# Configuration example: verify Grav version and apply per-user disk quota on Linux
php bin/grav --version
setquota -u www-data 1048576 1258291 0 0 /var/www
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
