Which versions of Grav CMS are affected by EUVD-2026-42904?

Grav CMS deployments face service availability risk when authenticated users upload files engineered to exhaust server storage, potentially causing complete system failure.. A patch is available.

How to fix or mitigate EUVD-2026-42904?

Within 24 hours: inventory all Grav CMS production deployments and audit which user accounts have file upload privileges. Within 7 days: disable non-administrator file uploads, restrict file uploads to non-archive types (prohibit .zip, .tar, .gz), enforce maximum upload file sizes under 100 MB, and implement disk usage monitoring with alerts at 80% capacity. Within 30 days: subscribe to Grav security advisories and develop upgrade plan for Grav 2.0.1 or later once the vendor releases the patch.

Grav CMS EUVD-2026-42904

Q: What is the CVSS score of EUVD-2026-42904?

EUVD-2026-42904 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-61455 HIGH

Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)

2026-07-10 VulnCheck

GHSA-jxpj-m582-7727

Denial Of Service Grav Getgrav

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable upload feature (AV:N/AC:L) requires an authenticated low-privilege account (PR:L); impact is pure disk-exhaustion DoS, so C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 16:16 EUVD

Analysis Generated

Jul 10, 2026 - 15:35 vuln.today

DescriptionCVE.org

Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

AnalysisAI

Denial of service in Grav CMS before 2.0.1 allows authenticated users to exhaust server storage by uploading a crafted ZIP archive (a decompression bomb) that the ZipArchiver::extract() routine expands without enforcing limits on uncompressed size, file count, or nesting depth. The CVSS 4.0 base score of 7.1 reflects a network-reachable, low-privilege flaw whose sole impact is high availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Grav is a flat-file, PHP-based content management system (CPE cpe:2.3:a:getgrav:grav) that accepts ZIP archives for functions such as package/plugin/theme installation and backup restoration. The vulnerable ZipArchiver::extract() method decompresses archive contents without validating the ratio between compressed input and uncompressed output. This maps directly to CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification): a small crafted archive containing highly redundant data and/or deep recursive nesting can expand by many orders of magnitude on disk. Because Grav is a flat-file CMS that writes extracted content to the filesystem rather than a database, uncontrolled expansion directly consumes finite disk resources.

RemediationAI

Vendor-released patch: Grav 2.0.1 - upgrade to version 2.0.1 or later, which adds limits to ZipArchiver::extract(), per the GitHub Security Advisory GHSA-928x-9mpw-8h56 (https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56) and the VulnCheck advisory (https://www.vulncheck.com/advisories/grav-before-decompression-bomb-via-ziparchiver). Where immediate upgrade is not possible, restrict ZIP upload/installation capabilities (plugin/theme/package install and backup restore) to a minimal set of fully trusted administrators, since PR:L means that feature is the attack surface; enforce filesystem quotas or place Grav's data directory on a dedicated partition so uncontrolled expansion cannot exhaust the root volume (trade-off: extraction of legitimate large archives may fail once the quota is hit); and add disk-usage monitoring with alerting so runaway extraction is detected quickly. These controls reduce but do not eliminate the risk, so patching remains the primary remediation.