THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-928x-9mpw-8h56 (medium) — Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

[GHSA] GHSA-928x-9mpw-8h56 (medium) — Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

medgithub_advisoriesPublished 2026-09-02

GHSA-928x-9mpw-8h56 Severity: medium CVE: CVE-2026-61690

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

## Summary `ZipArchiver::extract()` lacks limits on uncompressed size, file count, and nesting depth, creating a distinct, unpatched variant of the GHSA-2vcx-h8p2-9pg9 zip bomb vulnerability. While the parallel method Installer::unZip() received comprehensive limits, ZipA

Indicators of compromise

CVE-2026-61690cve

Original source: https://github.com/advisories/GHSA-928x-9mpw-8h56