CyberRota Analysis
AI-GeneratedGrav 2.0.1 is vulnerable to a decompression-bomb size-cap bypass in its ZipArchiver and GPM\Installer components, allowing attackers to craft ZIP archives that appear to meet size limits but extract significantly larger content, potentially filling disk space or exhausting inodes. This vulnerability poses a medium risk, primarily affecting systems where untrusted archives may be uploaded by administrators or package sources. Organizations using Grav 2.0.1 should prioritize upgrading to version 2.0.2 to mitigate this risk, despite the fix being noted as incomplete.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.