CVE-2026-59193 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

What is CVE-2026-59193?

CVE-2026-59193 is a medium-severity denial of service vulnerability in Getgrav Grav, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

Weakness: CWE-409

Which versions are affected by CVE-2026-59193?

2 open source packages ship an affected version, including getgrav/grav. It affects 1 product.

Products include Getgrav Grav.

How do I fix CVE-2026-59193?

Upgrade getgrav/grav to 2.0.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-59193 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59193 exists.

Other vulnerabilities in Getgrav Grav

• CVE-2023-34251 Grav Server Side Template Injection vulnerability Critical 10.0
• CVE-2025-46199 Cross-site scripting in n/a Critical 9.8
• CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) Critical 9.3
• CVE-2025-66844 Grav may be vulnerable to SSRF attack via Twig Templates Critical 9.1
• CVE-2022-2073 Code Injection in getgrav/grav Critical 9.1

All Getgrav Grav vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2vcx-h8p2-9pg9.