CVE-2026-59193

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

No known exploitation. EPSS puts it in the 48th percentile. A vendor fix is available.

CVSS 3.14.9Medium EPSS percentile48th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-10Updated 2026-07-10Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Getgrav GravAffected: >= 1.0.0, < 2.0.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check the installed Grav version and whether the Direct Install tool is available to administrator accounts.
Upgrade Grav to version 2.0.0.
Until upgraded, restrict or disable Direct Install access and do not allow ZIP uploads from untrusted sources.
Check available disk space and investigate unexpected large files in the Grav installation directory.

Vendor advisory Some work to apply

What it is

From the CVE record

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

In plain language

Written by AI from the record

Grav versions before 2.0.0 can be crashed or have their storage filled by a highly privileged administrator uploading a malicious ZIP file.

Authenticated denial of service in Grav Installer::unZip() through unbounded ZIP extraction, allowing archive-bomb disk exhaustion or resource exhaustion.

If you're affected

Website outage
Disk space exhaustion
Installation disruption

What is it

This is a weakness in Grav’s ZIP-file installation feature. A malicious ZIP file can act like a tiny suitcase that expands into a warehouse when opened, consuming the server’s storage and potentially taking the website offline.

Who is affected

This matters to you if you run grav and use its Direct Install feature to upload or install ZIP files. It is only a risk if an attacker already has a top-level administrator login.

How urgent is it

No public exploitation or public exploit code is known, and the issue is not listed in CISA’s catalog of vulnerabilities known to be exploited. Treat this as an amber priority: schedule the upgrade promptly, especially where administrator accounts or ZIP uploads are not tightly controlled.

What to do — in detail

Confirm the deployed Grav release is earlier than 2.0.0 and identify whether the Direct Install workflow is enabled and reachable by admin.super users. Upgrade to Grav 2.0.0, which contains the vendor’s remediation; review release and compatibility notes before moving from the pre-2.0 branch because this is a major-version upgrade.

If the upgrade must wait, disable or limit Direct Install, remove ZIP-upload capability from accounts that do not require it, and accept installation archives only from trusted sources. Monitor free disk capacity, web-server and PHP errors, failed installation attempts, and unexpected growth of extracted files or directories. CISA KEV has no due date because this CVE is not listed.

Technical context

CVSS 3.1: 4.9 (Medium): AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. CWE-409, improper handling of highly compressed data: Installer::unZip() used ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth, enabling ZIP-bomb-style denial of service. The attack requires authenticated admin.super privileges. No public exploit code is on record, CISA KEV does not list the CVE, and EPSS is 0.6% (47th percentile) with a flat trend. Press attention is rising but does not establish exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS48th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 48th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Affected products

getgravoss-projectaka getgrav/grav, grav, grav-plugin-admin
- gravCMS PluginOn-premWeb & CMS Plugins / cms-core

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Scored 4.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-409No name in the record

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Grav, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account