Grav CMS CVE-2026-61690

Exploitation requires an authenticated Grav session with sufficient privileges to upload or install archives through any code path invoking Archiver::create('zip') - specifically the ZipArchiver::extract() path triggered during plugin, theme, or package installation via the admin panel or GPM. The CVSS PR:L metric confirms that full administrative access is not required; a low-privilege account with upload or install capability is sufficient. The Grav admin panel or GPM must be enabled and accessible, which is the default configuration for sites using the Grav admin plugin. No special protocol, non-default setting, or external service is required beyond an accessible authenticated session. Exploitation is bounded by its pure availability impact: an attacker cannot read or modify data, only exhaust storage resources. Deployments where archive upload functionality is entirely disabled or inaccessible to non-admin users have a reduced but not eliminated attack surface.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately represents the threat profile: network-accessible, low complexity, requiring only a low-privilege authenticated account, with pure availability impact and no confidentiality or integrity exposure. KEV status is negative and no public exploit code has been identified, placing this in a 'track and patch' posture rather than emergency response for most organizations. EPSS data was not supplied in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified from this dataset - that is a gap in the available signals. The realistic risk is highest in shared-hosting or resource-constrained environments where disk exhaustion would cascade to affect co-located services; a mid-sized IT operation running multiple applications on a single server should treat this as a prompt patching-cycle item rather than a deferred issue. The absence of scope change (S:U) in the CVSS vector is technically conservative - disk exhaustion inherently affects the underlying host - but the primary, intended impact is the Grav application itself.

An attacker with a low-privilege Grav account (for example, a contributor or editor with plugin upload access) constructs a decompression bomb ZIP - a small compressed file whose entries expand to many gigabytes - and submits it for installation through the Grav admin panel or GPM. ZipArchiver::extract() passes the archive directly to ZipArchive::extractTo() without checking uncompressed size, file count, or nesting depth, causing the extraction to fill available disk space or exhaust inodes. The Grav site and any other services sharing the same filesystem become unavailable. Constructing a decompression bomb is a well-documented, trivially reproducible technique requiring no specialized tooling, though no public exploit targeting this specific code path has been identified.