CVE-2026-59193

MEDIUM 6.9 PoC AVAILABLE ALL-YEARS

Published 2026-07-10 · Last modified 2026-07-10 · GitHub_M · NVD: Modified

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

EXPLOIT AVAILABLE

Public exploit or PoC code exists. The barrier to attack is reduced — watch closely.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 32nd percentile

○ In CISA KEV● Public exploit / PoC◆ SSVC: exploitation poc, automatable no

Impact if exploited

6.9CVSS 4.0 · MEDIUM · CNA

ConfidentialityNone
IntegrityNone
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires an admin / high-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

reference https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9
github-search https://github.com/search?q=%22CVE-2026-59193%22&type=repositories

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-59193/poc.jsonMachine-readable PoC index for this CVE (for automation).

For defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-59193/poc.json

Affected

Vendors Getgrav

Products Grav

Weakness (CWE)

CWE-409: : Improper Handling of Highly Compressed Data (Data Amplification)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Known Affected Software Configurations

Vendor	Product	Version range
Getgrav	Grav	≥ 1.0.0 and < 2.0.0
Getgrav	Grav	2.0.0

All CVSS metrics

MEDIUM 6.9 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
MEDIUM 6.9 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MEDIUM 4.9 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References

Sources: NVD · CVE.org · EPSS