CVE-2026-59193 – Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

CVE ID :CVE-2026-59193

Published : July 10, 2026, 5:17 p.m. | 32 minutes ago

Description :Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

Severity: 6.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…