CVE-2026-61690

Grav's ZipArchiver::extract() calls ZipArchive::extractTo() without enforcing configured archive limits (uncompressed-size, file-count, nesting-depth). A low-privilege network attacker can submit a decompression bomb archive to exhaust disk space or inodes, causing denial of service. Fixed in Gra...