Description

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T16:18:16.867Z",
  "pubdate": "2026-08-19T16:18:16.867Z",
  "executiveSummary": "Grav prior to version 2.0.1 is affected by a resource exhaustion vulnerability in the archive extraction mechanism. The flaw specifically exists in the ZipArchiver::extract() method located within system/src/Grav/Common/Filesystem/ZipArchiver.php, which handles archive extraction via ZipArchive::extractTo().\nThe vulnerability stems from the application's failure to enforce configured system.gpm.archive limits regarding uncompressed-size, file-count, and nesting-depth when processing untrusted zip archives. An attacker capable of supplying a crafted malicious archive to code utilizing Archiver::create('zip') can trigger uncontrolled resource consumption.\nSuccessful exploitation allows an unauthenticated or privileged attacker—depending on the specific application context exposing the archive extraction functionality—to exhaust available disk space or consume all available inodes on the host file system. This results in a severe Denial of Service (DoS) condition, rendering the Grav-based web platform entirely unavailable.\nThe risk implications include operational downtime, potential cascading failures of other services sharing the same storage volume, and the requirement for manual administrative intervention to purge malicious files and restore service availability.",
  "technicalDetails": "The vulnerability resides in the Grav file-based web platform, specifically within the ZipArchiver::extract() function implemented in system/src/Grav/Common/Filesystem/ZipArchiver.php. The vulnerable component is responsible for processing and decompressing archive files using PHP's native ZipArchive::extractTo() method.\nThe root cause of the vulnerability is the complete omission of validation checks against defined security thresholds. Grav provides configuration parameters under system.gpm.archive intended to restrict resource usage during archive extraction, specifically targeting uncompressed-size limits, maximum file-count thresholds, and nesting-depth boundaries. However, the ZipArchiver::extract() implementation fails to enforce these parameters before passing the archive stream directly to the underlying extraction routines.\nExploitation occurs when an attacker crafts a malicious zip archive designed to maximize resource exhaustion upon extraction. This can take the form of a 'zip bomb' (a small compressed file that expands into gigabytes of data) or an archive containing millions of empty files designed to exhaust the file system's inode allocation.\nThe step-by-step attack flow proceeds as follows: First, the attacker delivers a maliciously crafted zip archive to the target system through an application feature that invokes Archiver::create('zip') to handle the extraction. Second, the application passes the archive to ZipArchiver::extract() for processing. Third, because the method lacks validation for uncompressed-size, file-count, and nesting-depth limits, the extraction process proceeds unabated. Fourth, the native ZipArchive::extractTo() function writes the full uncompressed payload or creates the massive hierarchy of files directly onto the disk. Finally, the target system's disk space or inode table is entirely exhausted, leading to critical application failure and denial of service.\nThe affected versions include all Grav installations prior to version 2.0.1. Depending on the attack vector utilizing the archive extraction functionality, network exposure and authentication requirements vary based on the specific module or plugin leveraging the vulnerable Archiver interface."
}