Grav CMS CVE-2026-61455

Exploitation requires an authenticated account (CVSS PR:L) with permission to reach a Grav feature that invokes ZipArchiver::extract() - specifically the ZIP-based package/plugin/theme installation or backup-restore upload paths - and the ability to supply an attacker-controlled ZIP archive to one of those endpoints. Limiting factors: valid low-privilege credentials and access to the extraction feature are mandatory (no anonymous/default-open path), and impact is confined to availability (disk exhaustion / DoS) with no data disclosure or code execution. Exploitability is further bounded by available free disk space and any pre-existing filesystem quotas on the Grav data volume.

The signals are internally consistent and point to a moderate, availability-only risk rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable attack of low complexity with no user interaction, but PR:L confirms the attacker must already hold authenticated low-privilege access - the extraction paths in Grav are administrative/upload features, not anonymous endpoints. Impact is strictly VA:H (availability) with VC:N/VI:N: no confidentiality or integrity loss and no scope change, consistent with a pure DoS. No EPSS score was provided in the input, there is no KEV listing, and no POC is referenced, so there is no evidence of active or imminent widespread exploitation. Practical priority is therefore driven by exposure: instances that grant untrusted or semi-trusted users upload/install rights warrant prompt patching, whereas single-admin deployments face limited real-world risk because the required privilege already implies substantial control.

An attacker holding a low-privilege authenticated account with access to Grav's upload or package-installation feature crafts a small ZIP decompression bomb (highly redundant data with deep nesting) and submits it to a function that calls ZipArchiver::extract(). Extraction proceeds without size or depth limits, expanding the archive until the server's disk fills, halting Grav and potentially other services on the same volume. No public exploit is identified at time of analysis, but the technique is well understood and trivial to reproduce.