Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-112782

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

getgrav grav

Default version status: unaffected

  • 2.0.0-rc.8 to < 2.2.2affected
  • 2.2.2unaffected

getgrav grav

Default version status: unaffected

  • 1.7.53 to < 1.7.53.5affected
  • 1.7.53.5unaffected

References