CVE-2026-61449 describes a decompression-bomb size-cap bypass vulnerability in Grav 2.0.1's ZipArchiver and GPM\Installer. The software enforces a size limit on uncompressed archives by summing declared sizes from ZIP central-directory headers before extraction. However, these declared sizes are attacker-forgeable and not cross-checked against the actual inflated data stream. Consequently, a crafted archive with small declared sizes can bypass the limit, but during extraction, the real, much larger data is written, potentially filling disk space or exhausting inodes. This attack requires the archive to come from a trusted source or admin upload, limiting exposure. The issue was fixed in Grav 2.0.2, though it is noted as an incomplete fix for a related advisory GHSA-928x-9mpw-8h56.

Successful exploitation can lead to resource exhaustion on the host system by filling disk space or exhausting inodes, potentially causing denial of service or operational disruption. The vulnerability requires administrative or trusted package upload privileges, so it does not allow remote unauthenticated exploitation. No evidence of active exploitation in the wild is reported.

A fix is available in Grav version 2.0.2. Users should upgrade to version 2.0.2 or later to remediate this vulnerability. Since the vulnerability requires trusted package sources or admin uploads, restricting upload permissions and verifying package sources can reduce risk. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 2.0.2. Check the official Grav advisory for the latest remediation guidance.