Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-59193
4.9
MEDIUMCVSS v3
Published
July 10, 2026
Affected
1 project
Assigned by
GitHub
Severity scale
010
Description
Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.
getgrav/grav
GitHubModern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
GitHubModern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony>= 1.0.0, < 2.0.0, = 2.0.0NVD