CyberRota Analysis
AI-GeneratedGrav's Direct Install tool is vulnerable to a denial-of-service condition, allowing an authenticated admin.super user to crash the system or exhaust disk space by uploading a maliciously crafted ZIP archive. The vulnerability arises from the lack of restrictions on the uncompressed size, entry count, or directory depth during the extraction process. Organizations using versions prior to 2.0.0 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)