CVE-2026-61455 describes a decompression bomb vulnerability in Grav's ZipArchiver::extract() prior to version 2.0.1. The vulnerability is due to missing limits on uncompressed data size, number of files, and nesting depth when extracting ZIP archives. This allows an attacker to supply a maliciously crafted ZIP file that expands disproportionately, exhausting disk storage and resulting in denial of service. The CVSS 4.0 base score is 7.1 (high severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation leads to denial of service by exhausting disk space on the affected system. This can disrupt normal operation of the Grav application and potentially impact availability of hosted services or websites. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or validating ZIP archive inputs to limit uncompressed size, file count, and nesting depth to mitigate the risk of decompression bombs.