CVE-2026-61449 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using versions before 2.0.2, should assess exposure and prioritize upgrading to mitigate this vulnerability. This includes operators, administrators, and security teams managing Grav deployments. They should review the vulnerability details, assess the potential impact, and implement necessary remediation steps to prevent exploitation.

Why it matters

Defenders should care about CVE-2026-61449 because it allows an attacker to bypass the size cap in ZipArchiver and GPM Installer, potentially leading to disk filling or inode exhaustion. This vulnerability requires verification of affected versions and remediation to prevent exploitation.

• Potential for disk filling or inode exhaustion
• Possible disruption of service due to resource exhaustion
• Need for verification of affected versions and remediation
• Importance of monitoring and restricting admin uploads and package sources

Technical summary

The vulnerability exists in Grav before 2.0.2, where an attacker can bypass the size cap in ZipArchiver and GPM Installer by crafting an archive with a forged ZIP size. This can lead to disk filling or inode exhaustion upon extraction. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. However, this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream.

Defensive priority

Defenders should prioritize upgrading to Grav 2.0.2 or later to mitigate this vulnerability. Additionally, monitoring and restricting admin uploads and package sources can help prevent exploitation.

Recommended defensive actions

• Upgrade to Grav 2.0.2 or later
• Monitor and restrict admin uploads and package sources
• Implement additional security measures to detect and prevent suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a size-cap bypass in ZipArchiver and GPM Installer, which allows an attacker to craft an archive that declares tiny per-entry sizes but writes much larger content upon extraction. The archive must be supplied by a package source or admin upload.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.