CVE-2026-59193: Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

September 16, 2026

An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method Installer::unZip() calls ZipArchive::extractTo() without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bomb (CWE-409), stack overflow (CWE-674), and disk/inode exhaustion.

References

github.com/advisories/GHSA-2vcx-h8p2-9pg9
github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781
github.com/getgrav/grav/releases/tag/2.0.0
github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9
nvd.nist.gov/vuln/detail/CVE-2026-59193

Code Behaviors & Features

Detect and mitigate CVE-2026-59193 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →