Answer in brief
CVE-2026-61449 records a High severity (CVSS 7.1) vulnerability in Grav before 2.0.2 Decompression Bomb via Forged ZIP Size. The current sources do not mark it as known exploited. The current feed maps getgrav/grav (composer), getgrav/grav (generic), getgrav/grav (packagist). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps getgrav/grav (composer), getgrav/grav (generic), getgrav/grav (packagist). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| getgrav/gravcomposer | =2.0.1 | 2.0.2 |
| getgrav/gravgeneric | >=0 <2.0.2 | 2.0.2 |
| getgrav/gravpackagist | >=2.0.1 <2.0.2 | 2.0.2 |
Published upstream
Jul 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.
Quoted source text, attributed separately from HOL analysis.