CVE-2026-59193

EUVD-2026-42951
Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
getgravgrav
1.0.0 ≤
𝑥
< 2.0.0
getgravgrav
2.0.0:beta1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781
https://github.com/getgrav/grav/releases/tag/2.0.0
https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9
https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9