CVE-2026-61455
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
6.5 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Description
Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-409
Source
NVD
Vendor
getgrav
Product
grav
Discussion (0)
Add Comment
No comments yet. Be the first!