Grav CMS EUVD-2026-42951

Exploitation requires an authenticated session with the admin.super role in Grav - the highest privilege tier, not standard admin. The attack specifically requires access to the Direct Install tool (plugin/theme ZIP upload interface), which is gated behind this role. Non-admin users and users with roles below admin.super cannot reach the vulnerable Installer::unZip code path. No special server configuration or non-default feature flag is required beyond having the Direct Install functionality enabled, which is on by default. The limiting factors are: (1) possession of valid admin.super credentials, (2) the ability to upload a file through the Direct Install UI, and (3) sufficient disk I/O and time to complete extraction - large zip bombs may be slow to trigger. Impact is constrained to availability (DoS); no code execution or data exfiltration is possible through this path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H) scores 6.9, accurately reflecting the trade-off between network accessibility and the high-privilege prerequisite. PR:H is the dominant risk-limiting factor: exploitation requires a fully privileged admin.super Grav account, meaning the threat model is primarily insider abuse, account takeover of an existing admin, or a misconfigured multi-tenant deployment. The purely availability-focused impact (VA:H, no C or I) means no data exfiltration or code execution is possible through this vector alone. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, indicating no confirmed or widespread exploitation. The absence of a public POC further reduces near-term opportunistic risk. In practice, this is a medium-priority hardening issue: organizations with strict admin account hygiene and a single-tenant Grav deployment face negligible real-world risk, whereas multi-tenant platforms granting admin.super access to untrusted users should treat this as urgent.

An attacker who has obtained admin.super credentials - through credential stuffing, phishing, or insider access - navigates to Grav's Direct Install tool and uploads a crafted ZIP archive containing deeply nested or highly repetitive entries that expand to many gigabytes upon extraction. ZipArchive::extractTo proceeds without limit, writing data until available disk space is consumed or the PHP process is killed, taking the Grav site offline. No public POC has been identified, but constructing a zip bomb is trivial with widely available tooling.