ProcessWire is a free and open-source content management system built with PHP. Although it is not as widely used as WordPress, BuiltWith reports that more than 20,000 websites use ProcessWire, while W3Techs estimates that it powers nearly 0.1% of all websites.
While reviewing ProcessWire’s (Version : 3.0.246) file-handling functionality, I discovered a resource-exhaustion vulnerability in the way the CMS processed certain ZIP archives. The issue was later assigned CVE-2025-60790.
In this article, I will explain how I found the issue and what caused it.
Affected Feature
ProcessWire has a language translation upload feature which allows a user with the role lang-edit to upload ZIP archives containing translation files. The application automatically extracts the uploaded ZIP archives which could allow an authenticated lang-edit role user to upload a crafted ZIP bomb.
How the ZIP Extraction Became Vulnerable
While reviewing the ZIP upload process, I first tested whether I could bypass the file-type checks and upload a malicious PHP file, but the attempt was unsuccessful. I later noticed that ProcessWire extracted uploaded archives before properly validating their contents.
The zip archive upload was handled by the WireUpload::saveUploadZip() function, which passed the archive to WireFileTools::unzip() for extraction without checking the uncompressed size, number of files or directory depth.
This meant that a small ZIP bomb could expand into several gigabytes of data during extraction. ProcessWire checked the extracted files only after the extraction was complete. By that point, the server had already consumed disk space, CPU time, and other resources.
During the security testing, I also found that when an archive contained multiple nested ZIP files, the cleanup process removed only the first one it encountered. The remaining nested ZIP files were left in the language files directory.
Potential Impact
The exploitation require a valid account with lang-edit permission. A user with the permission could upload a malicious ZIP file that expands into a very large amount of data. Extracting it could overload the server's storage, CPU and other resources and cause potential denial-of-service (DoS). As it require a valid account the risk reduced but a lower privileged user account shouldn't be trusted blindly ! The zero-trust principle should be applied for such role.
Security Lessons
This vulnerability shows that upload restrictions should not focus only on the compressed file size. A small ZIP archive can expand into gigabytes of data once extracted. Therefore, when testing a ZIP upload feature, even if you cannot bypass the file-type restrictions, you should still check whether the application is vulnerable to ZIP bomb attacks.
Disclosure Timeline
-
August 20, 2025: I reported the vulnerability through the ProcessWire issue tracker, including technical details and a proof of concept.
-
October 21, 2025: The vulnerability was published as CVE-2025-60790.
-
January 23, 2026: ProcessWire announced version 3.0.255, which included a rewritten ZIP extraction method and a new
FileValidatorZipmodule.
During the discussion, the maintainer noted that the language-management interface was designed for trusted users. However, authenticated and lower-privileged accounts can still be compromised or misused.
ProcessWire later introduced additional ZIP validation controls, including limits on the number of files, directory depth, total uncompressed size, individual file size, and compression ratio. Users should upgrade to ProcessWire 3.0.255 or later.
References
- ProcessWire Github Issue
- Official CVE-2025-60790 record
- ProcessWire 3.0.255 release announcement
- Snyk vulnerability advisory
