EUVD-2026-44647
GHSA-8h9x-89f2-m7x3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain admin upload rights or control a GPM package source
-
DeliveryCraft ZIP with forged tiny central-directory sizes
-
ExploitSubmit archive, passing 2.0.1 size cap
-
ExecutionextractTo() inflates real oversized content
-
ImpactDisk/inode exhaustion, site denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Exploitation requires the ability to deliver a crafted ZIP archive through a trusted channel - either an admin/operator upload via the Grav admin panel or a package source consumed by GPM\Installer - so an untrusted, fully unauthenticated attacker cannot reach the sink in a default configuration. The specific precondition is that system.gpm.archive.max_uncompressed_size enforcement is active (the 2.0.1 cap) and that the archive's central-directory per-entry sizes are forged smaller than the true inflated content. Limiting factors: the attacker needs admin/operator trust or control of a package source, and an operator must actually trigger the install/extraction (user interaction), which confines realistic exploitation to insider misuse or supply-chain compromise of a package feed rather than opportunistic remote attacks. |
| Impact | The vendor CVSS 4.0 score of 7.1 (VA:H, availability-only) reflects a pure resource-exhaustion outcome - no confidentiality or integrity impact - and the vector's PR:N conflicts with the description, which explicitly states the archive must come from a package source or admin/operator upload. That trust requirement materially lowers real-world risk: this is not remote-unauthenticated, so it is better read as a privileged-actor or supply-chain integrity concern than a broadly exploitable network DoS. There is no EPSS score, POC, or KEV listing in the provided data, so exploitation probability signals are absent rather than reassuringly low. Net assessment: a legitimate hardening bug and a genuine defense-in-depth gap for GPM/upload workflows, but a moderate operational priority - patch on a normal cycle unless untrusted parties can influence package sources. Note the discrepancy explicitly: CVSS marks PR:N/AV:N while the description requires operator trust - verify the true attacker model against your deployment before rating it network-exploitable. |
| Exploit ScenarioDerived | An operator with admin upload rights, or a malicious/compromised GPM package source, offers a plugin archive whose ZIP entries declare only a few kilobytes each so it passes Grav 2.0.1's max_uncompressed_size check. When the admin installs it, extractTo() inflates the entries into gigabytes of real data, filling the disk or exhausting inodes and taking the site offline. No public POC is identified in the provided data, but the technique is straightforward to reproduce given ZIP header manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Denial of service in Grav CMS 2.0.1 lets a trusted package source or admin-level uploader bypass the newly added decompression-bomb size cap and exhaust disk space or inodes on the host. The 2.0.1 cap trusts the attacker-forgeable uncompressed size declared in each ZIP central-directory entry rather than the actual inflated stream, so a crafted archive declaring tiny sizes slips past the check while extraction writes the real, far larger payload. This is an incomplete fix for GHSA-928x-9mpw-8h56, corrected in 2.0.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade to Grav 2.0.2, which cross-checks the actual inflated stream size against the cap instead of trusting the declared central-directory sizes (Vendor-released patch: 2.0.2; see GHSA-8h9x-89f2-m7x3). Until you can patch, restrict who can supply archives: limit admin panel plugin/theme upload permissions to a minimal set of trusted operators, and pin GPM package sources to trusted repositories only rather than arbitrary URLs - the trade-off is reduced convenience for installing third-party or ad-hoc packages. As a host-level compensating control, place Grav's extraction/temp and data directories on a filesystem with disk quotas or a dedicated partition so a bomb cannot exhaust the root volume or global inode table, accepting that legitimate large installs may hit the quota. Monitor free disk space and inode consumption during GPM operations to detect abuse. Reference: vendor advisory GHSA-8h9x-89f2-m7x3 and VulnCheck advisory linked above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a PHP-based flat-file CMS, and the flaw lives in its archive-handling code - the ZipArchiver helper and the GPM\Installer used for plugin/theme/package installation. The 2.0.1 mitigation summed ZipArchive::statIndex()['size'] across entries and rejected archives whose declared total exceeded system.gpm.archive.max_uncompressed_size before calling extractTo(). The root cause is CWE-409 (Improper Handling of Highly Compressed Data / data amplification): the size bound is derived from the ZIP central-directory metadata, which is fully attacker-controlled and never reconciled against the number of bytes actually inflated by extractTo(). Because PHP's ZipArchive reports the header-declared size rather than the true decompressed length, the pre-extraction guard can be trivially defeated by writing false per-entry sizes.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Requires admin/operator upload or a trusted package source (PR:H) and an operator action to trigger extraction (UI:R); impact is availability-only disk/inode exhaustion (A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.
Executive ViewAI
Grav CMS 2.0.1 contains a denial-of-service vulnerability in package decompression that allows administrators or trusted package sources to exhaust disk storage and inodes, risking service unavailability. No public exploit has been identified. Organizations running this version must upgrade to address an incomplete prior security fix.
Apply vendor patch (Grav CMS 2.0.2). If immediate upgrade is not feasible, restrict package uploads to verified administrators and implement disk usage monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB