CVE-2026-61455CWE-409

CVE-2026-61455

Medium · published July 10, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.6th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-07-10T19:16Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56 · [email protected]https://www.vulncheck.com/advisories/grav-before-decompression-bomb-via-ziparchiver · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 JUL 13:58Z
    Grav before 2.0.1 Decompression Bomb via ZipArchiver
    cvelistv5