https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:07:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335734 EUVD-2026-335734 https://cve.radiocsirt.org/vuln/euvd-2026-335734 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59193 <p>Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.</p> <p>Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59193 https://cve.radiocsirt.org/vuln/ghsa-2vcx-h8p2-9pg9 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method `Installer::unZip()` calls `ZipArchive::extractTo()` without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bomb (CWE-409), stack overflow (CWE-674), and disk/inode exhaustion. ### Details The vulnerability is in `system/src/Grav/Common/GPM/Installer.php:176-208` (`Installer::unZip()`). The `ZipArchive::extractTo()` call at line 184 is not preceded by any validation of the archive contents.</p> <p>Missing validation: - ❌ No total uncompressed size check (decompression bomb — CWE-409) - ❌ No entry count check (inode exhaustion) - ❌ No directory nesting depth check (stack overflow in `Folder::doDelete()` — CWE-674)</p> <p>The subsequent cleanup call `Folder::delete($destination)` at line 189 recursively deletes every subdirectory without depth limit (`Folder.php:531-547`). A ZIP with thousands of nested directories will cause PHP&#39;s maximum nesting level to be exceeded, so the cleanup fails silently and leaves extracted files on disk.</p> <p>The existing Zip Slip fix (GHSA-w48r-jppp-rcfw / CVE-2026-42607, commit 5a12f9be8) only checks for `../` in entry paths and does not add any size, count, or depth limits. ### PoC 1. Generate the malicious ZIP:</p> <p>python3 cve_poc_grav_zip.py: ```python #!/usr/bin/env python3 &#34;&#34;&#34; CVE PoC — Grav CMS Installer::unZip() Zip Bomb + Zip Slip + Deep Nesting ZIP file to a…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method `Installer::unZip()` calls `ZipArchive::extractTo()` without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bomb (CWE-409), stack overflow (CWE-674), and disk/inode exhaustion. ### Details The vulnerability is in `system/src/Grav/Common/GPM/Installer.php:176-208` (`Installer::unZip()`). The `ZipArchive::extractTo()` call at line 184 is not preceded by any validation of the archive contents.</p> <p>Missing validation: - ❌ No total uncompressed size check (decompression bomb — CWE-409) - ❌ No entry count check (inode exhaustion) - ❌ No directory nesting depth check (stack overflow in `Folder::doDelete()` — CWE-674)</p> <p>The subsequent cleanup call `Folder::delete($destination)` at line 189 recursively deletes every subdirectory without depth limit (`Folder.php:531-547`). A ZIP with thousands of nested directories will cause PHP&#39;s maximum nesting level to be exceeded, so the cleanup fails silently and leaves extracted files on disk.</p> <p>The existing Zip Slip fix (GHSA-w48r-jppp-rcfw / CVE-2026-42607, commit 5a12f9be8) only checks for `../` in entry paths and does not add any size, count, or depth limits. ### PoC 1. Generate the malicious ZIP:</p> <p>python3 cve_poc_grav_zip.py: ```python #!/usr/bin/env python3 &#34;&#34;&#34; CVE PoC — Grav CMS Installer::unZip() Zip Bomb + Zip Slip + Deep Nesting ZIP file to a…</p> https://cve.radiocsirt.org/vuln/ghsa-2vcx-h8p2-9pg9