Is there a patch available for CVE-2026-59193?

Yes, a patch is available for CVE-2026-59193. Update the affected software to the latest version immediately.

Grav CMS CVE-2026-59193

Q: What is the CVSS score of CVE-2026-59193?

CVE-2026-59193 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42951 MEDIUM

Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)

2026-07-10 GitHub_M

Denial Of Service Grav Getgrav

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Network-reachable upload endpoint but PR:H reflects mandatory admin.super authentication; purely availability impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 18:01 EUVD

Analysis Generated

Jul 10, 2026 - 17:35 vuln.today

DescriptionCVE.org

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

AnalysisAI

Disk exhaustion and crash vulnerability in Grav's Direct Install tool allows an authenticated admin.super user to upload a specially crafted ZIP archive that decompresses without bound, filling the server disk or crashing the process. Affecting all Grav releases prior to 2.0.0, the root cause is the Installer::unZip method invoking PHP's ZipArchive::extractTo with no enforced limits on uncompressed size, entry count, or directory depth - a classic zip bomb attack surface. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released fix is available in version 2.0.0.

Technical ContextAI

Grav (CPE: cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*) is a PHP-based flat-file CMS that uses a Direct Install feature allowing admins to install plugins and themes by uploading ZIP archives. The vulnerable code path is Installer::unZip, which delegates decompression to PHP's built-in ZipArchive::extractTo. CWE-409 (Improper Handling of Highly Compressed Data) describes this class of flaw: a maliciously crafted ZIP archive can encode a large volume of repetitive data at extreme compression ratios (zip bomb), causing the extraction routine to write gigabytes or more of output to disk. Without limits on uncompressed entry size, total extracted size, recursive entry count, or directory nesting depth, a single upload call can exhaust available disk space or trigger an out-of-memory crash, neither of which requires any post-upload interaction from the server.

RemediationAI

Upgrade to Grav 2.0.0, which introduces extraction limits in Installer::unZip to prevent zip bomb decompression. The patched release and advisory are available at https://github.com/getgrav/grav/releases/tag/2.0.0 and https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9, and the fixing commit is https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781. If an immediate upgrade is not feasible, restrict the admin.super role to the minimum number of trusted accounts and audit existing assignments, since this is the only role capable of triggering the vulnerable Direct Install code path. As an additional compensating control, consider disabling the Direct Install/plugin upload feature at the web server or application configuration level and requiring manual file-system-level plugin deployment, accepting the trade-off of increased operational friction for reduced attack surface.