Recent analysis has identified a significant vulnerability within file extraction routines, carrying a CVSS v3 score of 6.5. This security flaw allows malicious actors to bypass built-in resource limits by manipulating header metadata within compressed archives. Consequently, systems processing untrusted packages may experience unexpected storage exhaustion and subsequent service degradation. The issue stems from trusting unverified metadata values rather than enforcing strict validation during actual content extraction phases.
CVE-2026-61449: The vulnerability resides in the archive processing components utilized for package installation and administrative backups, specifically within archive extraction handlers. An unauthenticated or privileged attacker can forge the declared uncompressed size inside the central directory of a ZIP archive. When processed, the system sums these untrusted values, successfully circumventing the configured maximum uncompressed size restriction. During actual extraction, the underlying library writes the full, inflated stream to disk, bypassing safety checks and risking complete storage capacity exhaustion.[/subscribe_to_unlock_form]
Recent analysis has identified a significant vulnerability within file extraction routines, carrying a CVSS v3 score of 6.5. This security flaw allows malicious actors to bypass built-in resource limits by manipulating header metadata within compressed archives. Consequently, systems processing untrusted packages may experience unexpected storage exhaustion and subsequent service degradation. The issue stems from trusting unverified metadata values rather than enforcing strict validation during actual content extraction phases.
CVE-2026-61449: The vulnerability resides in the archive processing components utilized for package installation and administrative backups, specifically within archive extraction handlers. An unauthenticated or privileged attacker can forge the declared uncompressed size inside the central directory of a ZIP archive. When processed, the system sums these untrusted values, successfully circumventing the configured maximum uncompressed size restriction. During actual extraction, the underlying library writes the full, inflated stream to disk, bypassing safety checks and risking complete storage capacity exhaustion.[emaillocker id="1283"]
Implementing robust validation practices remains essential to neutralize archive-based denial of service vectors across all managed application environments. Administrators should immediately apply available software updates to ensure extraction routines verify real-time byte streams instead of relying solely on header metadata. Continuous monitoring of disk utilization during package installation processes helps detect anomalous resource consumption early.
We recommend you to update Grav to version 2.0.2.
The following reports contain further technical details:
[/emaillocker]