CVE-2026-59193: Getgrav Grav

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

Affected products

• Getgrav Grav: from 1.0.0, before 2.0.0 (fixed in 2.0.0); version 2.0.0 only

Published 2026-07-10. Last modified 2026-07-10.