Medium severity6.5NVD Advisory· Published Aug 19, 2026· Updated Sep 9, 2026

CVE-2026-61690

Description

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
getgrav/gravPackagist	< 2.0.1	2.0.1

Affected products

Grav CMS/Gravllm-fuzzy
Range: <2.0.1
ghsa-coords
pkg:composer/getgrav/grav
Range: < 2.0.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-928x-9mpw-8h56ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-61690ghsaADVISORY
github.com/getgrav/grav/commit/1c1003cfcab5344203d6fde1aaa1f9a4ee3413ffnvdWEB
github.com/getgrav/grav/releases/tag/2.0.1nvdWEB
github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56nvdWEB

News mentions

Grav CMS: 14 Vulnerabilities Including Critical Privilege Escalation Disclosed Together
Vypr Intelligence · Aug 19, 2026

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000