{"vulnerability": "CVE-2026-59193", "sightings": [{"uuid": "cf492a3a-d358-4988-9dc9-4bd83ea15d24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59193", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbicyild2z", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59193 \u0432 Grav: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0432\u0435\u0431-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\n\n\n\nhttps://kripta.biz/posts/B23F11D5-D91E-4846-95BD-96FFBD313EA2", "creation_timestamp": "2026-07-10T23:11:33.989454Z"}, {"uuid": "48244ee4-78ea-4523-85c9-5ffb1c70f238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59193", "type": "published-proof-of-concept", "source": "https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9", "content": "", "creation_timestamp": "2026-09-17T00:35:12.555538Z"}, {"uuid": "8d851d42-49a9-4c98-9ee0-74c5e695d600", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59193", "type": "seen", "source": "https://gist.github.com/alon710/b4c3012210552826178a239bffbc7d9c", "content": "# CVE-2026-59193: CVE-2026-59193: Remote Denial of Service via Resource Exhaustion in Grav CMS\n\n> **CVSS Score:** 4.9\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59193\n\n## Summary\nA denial-of-service (DoS) and resource exhaustion vulnerability exists in Grav CMS prior to version 2.0.0. The package installer decompressor fails to validate ZIP archive limits before extraction, allowing authenticated administrators to cause disk exhaustion, inode exhaustion, or process termination.\n\n## TL;DR\nAn unvalidated ZIP archive extraction flaw in Grav CMS allows administrators to crash the server or fill up disk space using malicious zip files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409, CWE-674\n- **Attack Vector**: Network (Authenticated)\n- **CVSS v3.1**: 4.9 (Medium)\n- **EPSS Score**: 0.006 (0.60%)\n- **Exploit Status**: Proof of Concept / Technical Tests\n- **CISA KEV**: Not Listed\n- **Impact**: Denial of Service (Disk space exhaustion, Inode exhaustion, Process Crash)\n\n## Affected Systems\n\n- Grav CMS < 2.0.0\n- Grav CMS 2.0.0-beta1 to 2.0.0-rc.10\n- **Grav CMS**: >= 1.0.0, < 2.0.0 (Fixed in: `2.0.0-rc.11 / 2.0.0`)\n- **Grav CMS**: 2.0.0-beta.1 - 2.0.0-rc.10 (Fixed in: `2.0.0-rc.11`)\n\n## Mitigation\n\n- Upgrade Grav CMS to version 2.0.0 or higher.\n- Configure tight resource thresholds inside system/config/system.yaml.\n- Restrict admin.super permissions to trusted administrative users.\n- Enable the official_gpm_only setting to prevent unofficial archive installation.\n\n**Remediation Steps:**\n1. Identify active Grav CMS deployments and retrieve their current version numbers.\n2. Deploy the 2.0.0 patch or the development release 2.0.0-rc.11 or above.\n3. Edit system/config/system.yaml and configure 'gpm.archive.max_uncompressed_size' to 1073741824, 'gpm.archive.max_files' to 50000, and 'gpm.archive.max_depth' to 48.\n4. Audit the user permission database to remove 'admin.super' privileges from accounts that do not strictly require system-level maintenance capabilities.\n\n## References\n\n- [https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781](https://github.com/getgrav/grav/commit/23d6f2adf4ce11889c088ac8557c8314baeef781)\n- [https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9](https://github.com/getgrav/grav/security/advisories/GHSA-2vcx-h8p2-9pg9)\n- [https://github.com/getgrav/grav/releases/tag/2.0.0](https://github.com/getgrav/grav/releases/tag/2.0.0)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-59193](https://nvd.nist.gov/vuln/detail/CVE-2026-59193)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59193) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T06:32:02.176010Z"}]}