CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.1 are vulnerable to a decompression bomb in the ZipArchiver::extract() function, which does not impose limits on uncompressed size, file count, or nesting depth. This flaw allows attackers to exploit crafted ZIP archives to exhaust disk space, leading to denial of service. Organizations using affected versions should prioritize patching to mitigate potential disruptions to service availability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.