CVE-2026-61690

6.5 Moyenne

Publiée le 19/08/2026 à 18:18 · Modifiée le 09/09/2026 à 23:13 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1.

Traduire en français

Produits concernés

getgrav grav

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-409

Références

https://github.com/getgrav/grav/commit/1c1003cfcab5344203d6fde1aaa1f9a4ee3413ff
https://github.com/getgrav/grav/releases/tag/2.0.1
https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56
https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories