CVE-2026-59193: Remote Denial of Service via Resource Exhaustion in Grav CMS

Vulnerability ID: CVE-2026-59193
CVSS Score: 4.9
Published: 2026-09-16

A denial-of-service (DoS) and resource exhaustion vulnerability exists in Grav CMS prior to version 2.0.0. The package installer decompressor fails to validate ZIP archive limits before extraction, allowing authenticated administrators to cause disk exhaustion, inode exhaustion, or process termination.

TL;DR

An unvalidated ZIP archive extraction flaw in Grav CMS allows administrators to crash the server or fill up disk space using malicious zip files.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-409, CWE-674
• Attack Vector: Network (Authenticated)
• CVSS v3.1: 4.9 (Medium)
• EPSS Score: 0.006 (0.60%)
• Exploit Status: Proof of Concept / Technical Tests
• CISA KEV: Not Listed
• Impact: Denial of Service (Disk space exhaustion, Inode exhaustion, Process Crash)

Affected Systems

• Grav CMS < 2.0.0
• Grav CMS 2.0.0-beta1 to 2.0.0-rc.10
• Grav CMS: >= 1.0.0, < 2.0.0 (Fixed in: 2.0.0-rc.11 / 2.0.0)
• Grav CMS: 2.0.0-beta.1 - 2.0.0-rc.10 (Fixed in: 2.0.0-rc.11)

Code Analysis

Commit: 23d6f2a

Fix zip-bomb vulnerability by checking size, depth and file count prior to extraction (GHSA-2vcx-h8p2-9pg9)

Exploit Details

• GitHub Security Advisory Tests: Functional unit tests (ZipBombSecurityTest.php) verifying archive boundaries and rejection behavior.

Mitigation Strategies

• Upgrade Grav CMS to version 2.0.0 or higher.
• Configure tight resource thresholds inside system/config/system.yaml.
• Restrict admin.super permissions to trusted administrative users.
• Enable the official_gpm_only setting to prevent unofficial archive installation.

Remediation Steps:

1. Identify active Grav CMS deployments and retrieve their current version numbers.
2. Deploy the 2.0.0 patch or the development release 2.0.0-rc.11 or above.
3. Edit system/config/system.yaml and configure 'gpm.archive.max_uncompressed_size' to 1073741824, 'gpm.archive.max_files' to 50000, and 'gpm.archive.max_depth' to 48.
4. Audit the user permission database to remove 'admin.super' privileges from accounts that do not strictly require system-level maintenance capabilities.

References

• https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781
• https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9
• https://github.com/getgrav/grav/releases/tag/2.0.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-59193

Read the full report for CVE-2026-59193 on our website for more details including interactive diagrams and full exploit analysis.