vulnerability / NVI-00008013 / Revision 1

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

OSV carries this publisher advisory for getgrav/grav. This is an aggregated source copy; consult the original publisher and compare update dates.

source listedactiveGHSA-928x-9mpw-8h56

This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.

01 / Meaning

Why it matters

Published affected context helps an owner decide what evidence to gather. This report has not examined your application.

02 / Applicability

The affected context

Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.

getgrav/grav

source listed

ECOSYSTEM: introduced 0; fixed 2.0.1

## Summary `ZipArchiver::extract()` lacks limits on uncompressed size, file count, and nesting depth, creating a distinct, unpatched variant of the GHSA-2vcx-h8p2-9pg9 zip bomb vulnerability. While the parallel method Installer::unZip() received comprehensive limits, ZipArchiver::extract() remains unprotected, leaving a separate code path vulnerable to the same attack vector. The vulnerability is a distinct, unpatched variant of the bug described in GHSA-2vcx-h8p2-9pg9, as it affects a separate code path in the same codebase, implementing the same abstract class. --- ## Details **Vulnerable code** - `system/src/Grav/Common/Filesystem/ZipArchiver.php:29-58`: ```php public function extract($destination, ?callable $status = null) { $zip = new ZipArchive(); $archive = $zip->open($this->archive_file); if ($archive === true) { Folder::create($destination); // Only guards against Zip Slip (path traversal) for ($i = 0, $count = $zip->count(); $i getNameIndex($i); if ($name !== false && !$this->isSafeEntryPath($name)) { $zip->close(); throw new RuntimeException(.

GitHub Advisory Database via OSV

03 / Response

What to do next

vendor patch
The original advisory lists fixed boundaries 2.0.1 for getgrav/grav. Confirm the publisher’s latest guidance.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

A fixed release is not deployment evidence.

Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.

04 / Limits

What this report cannot establish

Customer inventory, deployment, reachability and exploitation have not been inspected.

Read the collection and interpretation limits ↗

05 / Provenance

Sources you can inspect

Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.

GHSA-928x-9mpw-8h56 ↗
GitHub Advisory Database via OSV · vendor advisory
Observed Oct 31, 2026. GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.

Public revision history

Only published revisions appear here. Routine fetches do not create a material-change event.

Revision 1 · Oct 31, 2026
First indexed by Null; source disclosure date is shown separately.

Read the public revision data ↗