CVE-2026-61690

CVE-2026-61690 is a zip extraction vulnerability where the real danger isn't the resource exhaustion itself — it's the gap between what Grav's configuration promises and what the code actually does. The system.gpm.archive settings define uncompressed-size, file-count, and nesting-depth limits that an auditor would reasonably assume are enforced. They're not. ZipArchiver::extract() runs without reading those values. The extraction is unbounded regardless of what the configuration declares. Having unenforced limits is more dangerous than having none at all. A developer searching Grav's codebase for "gpm.archive" will find those limits documented and conclude extraction is protected. A security scanner checking for documented controls will flag them as present. The configuration creates false assurance — it tells an attacker their target thought about resource limits but failed to implement them. When reviewing the 2.0.1 patch, don't stop at verifying ZipArchiver was fixed. Check whether TarArchiver, RarArchiver, and any other archiver classes were updated — or whether they share the same disconnect. The fix should centralize enforcement (a single policy checked before any extraction) rather than per-class wiring that can drift again. If Grav's automated plugin/theme update mechanism uses these same archivers without limits, a malicious archive uploaded to a compromised update repository could exhaust servers pulling updates across the supply chain. The deeper architectural question: does Grav's security model depend on developers manually wiring controls, or does the fix establish a pattern that makes unenforced extraction impossible by construction? Any archiver added in future should inherit limits automatically.

Reviewed through automated stages and approved by a human before publication.