PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59193 Getgrav CVE debrief

CVE-2026-59193 is a vulnerability in Grav, a file-based Web platform, where an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. This issue arises because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. The vulnerability is fixed in version 2.0.0. Affected users should be aware of this vulnerability and ensure they are using version 2.0.0 or later to prevent potential crashes or disk space issues.

Vendor
Getgrav
Product
Grav
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-10
Original CVE updated
2026-07-10
Advisory published
2026-07-10
Advisory updated
2026-07-10

Who should care

Users of Grav, especially those with admin.super privileges, should be aware of this vulnerability and ensure they are using version 2.0.0 or later to prevent potential crashes or disk space issues. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions.

Technical summary

The vulnerability in Grav allows an authenticated admin.super user to upload a specially crafted ZIP archive that can cause the system to crash or fill the disk. This is due to the lack of validation in the Installer::unZip function when calling ZipArchive::extractTo. The issue has been addressed in version 2.0.0. Affected users should update to prevent potential crashes or disk space issues. This vulnerability affects Grav, a file-based Web platform, and users with admin.super privileges should be cautious. Ensure version 2.0.0 or later is used, and monitor for unusual activity. Review vendor guidance and consider compensating controls for exposed systems.

Defensive priority

Medium priority should be given to updating Grav to version 2.0.0 or later, especially in environments where admin.super users have the ability to upload ZIP archives.

Recommended defensive actions

  • Update Grav to version 2.0.0 or later
  • Restrict admin.super user privileges
  • Monitor disk space and system logs for unusual activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-10T17:17:02.773Z and was last modified on 2026-07-10T20:16:48.807Z. The NVD entry is currently Modified. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The vulnerability affects Grav, a file-based Web platform, and is fixed in version 2.0.0.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-10T17:17:02.773Z and has not been modified since then.