CVE-2026-61455: Grav Decompression Bomb DoS Vulnerability – Patch Guidance

Technical summary

CVE-2026-61455 is a decompression bomb vulnerability residing in the ZipArchiver::extract() method of Grav before version 2.0.1. The vulnerability stems from the absence of controls on three key dimensions: total uncompressed size, number of extracted files, and directory nesting depth. An attacker who can interact with the ZIP extraction functionality (typically requiring authentication) can construct a pathological ZIP archive—one where a small compressed file expands to consume gigabytes or terabytes of disk space—or contains hundreds of thousands of files, or exhibits deep recursive folder structures. This exhausts the target system's available storage, rendering the Grav instance unable to function and potentially affecting other services on the same server.

Business impact

The denial-of-service impact is operationally severe for organizations relying on Grav for content management. An attack can render the CMS completely unavailable, disrupting website availability and content updates. For multi-tenant or shared hosting environments, a malicious user's attack can degrade performance or consume resources intended for other applications. Recovery requires manual disk space cleanup and potential downtime to restore service. The requirement for authentication mitigates some risk but does not eliminate it: compromised accounts, insider threats, or legitimate users with administrative privileges represent credible attack vectors.

Affected systems

Grav versions prior to 2.0.1 are affected. Organizations running Grav 2.0.0 and earlier releases should treat this as a priority for upgrade planning. The vulnerability is present in any deployment where the ZIP extraction functionality is enabled and accessible to authenticated users—which is the default configuration for most Grav installations that handle file uploads or imports.

Exploitability

Exploitation requires prior authentication and the ability to trigger ZIP extraction. The CVSS 3.1 score of 6.5 (Medium severity) reflects this authentication barrier: the attack vector is network-based with low attack complexity, but the attacker must first obtain valid credentials. Once authenticated, the attacker requires no user interaction on the target system to succeed. The attack is deterministic and does not depend on luck or timing. Organizations with weak credential hygiene, shared accounts, or a large number of privileged users face elevated risk.

Remediation

Upgrade Grav to version 2.0.1 or later. This release includes fixes that enforce limits on uncompressed archive size, file count, and nesting depth, preventing decompression bomb attacks. Administrators should verify the upgrade patches are in place before resuming operations. In parallel, review access controls: minimize the number of users with file upload or import permissions, enforce strong authentication, and monitor for suspicious ZIP uploads.

Patch guidance

Verify your current Grav version using the administration panel or by checking the version file. If running 2.0.0 or earlier, plan an upgrade to 2.0.1 at your earliest opportunity. Consult the official Grav release notes and security advisories for version 2.0.1 to confirm the specific changes and any compatibility notes. Test the upgrade in a staging environment before production deployment.

Detection guidance

Monitor application logs for unusual ZIP extraction activity, particularly uploads or imports of abnormally large or complex archives. Track disk utilization trends; a sudden spike or sustained high usage following a user file upload may indicate an attack in progress. For proactive detection, inspect incoming ZIP files before decompression: reject archives with uncompressed sizes exceeding a threshold (e.g., 10× the compressed size), excessive file counts (e.g., >10,000 files), or deep nesting (e.g., >10 levels). Review access logs to identify which authenticated users are initiating extraction requests.

Why prioritize this

Although classified as Medium severity, this vulnerability warrants expedited attention in environments where Grav is internet-facing or handles untrusted content. The authentication requirement prevents zero-day mass exploitation, but the simplicity of crafting a decompression bomb, combined with the severe operational impact (complete availability loss), justifies rapid patching. Organizations should prioritize this ahead of lower-impact vulnerabilities but may sequence it after critical zero-day threats.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with low attack complexity and an authentication prerequisite. The 'High' impact on availability (A:H) reflects the denial-of-service nature; integrity and confidentiality are unaffected (both 'None'). The authentication requirement (PR:L) prevents the score from reaching 'High' or 'Critical' range. In practice, risk is modulated by your threat model: if Grav administrators are trusted insiders and upload volumes are low, risk is lower; if the system is exposed to many external collaborators or integrates with automated import pipelines, risk is higher.

Frequently asked questions