Grav CMS CVE-2026-109324

Requires an authenticated account with media-author (upload) privileges to introduce a maliciously crafted, highly compressed oversized raster image (PR:L confirmed by CVSS). The decode-amplification only triggers when the image is rendered through a Twig or Markdown image transform, meaning server-side image processing via GD or Imagick must be active and the transform must lack source-dimension validation (the vulnerable behavior fixed before 2.1.7). The amplifying/limiting factor is this split: the setup needs author privileges, but once the transformed image is embedded in published content, unauthenticated/anonymous HTTP requests to that page repeatedly trigger memory exhaustion, so the sustained-DoS trigger is not itself privileged. Mitigation is to upgrade to Grav 2.1.7 or later and/or restrict media-author trust.

This is a moderate-priority availability issue, not a critical emergency. The CVSS 4.0 base score of 7.1 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) - it is purely a denial-of-service data-amplification flaw (CWE-409). The vector shows network attack (AV:N), low complexity (AC:L), and crucially low privileges (PR:L), meaning the initial upload requires an authenticated media-author account, which substantially limits the attacker population versus a fully unauthenticated flaw. There is an important nuance the single CVSS vector obscures: the description indicates a two-stage exploit - an authenticated media author plants an oversized compressed raster image, but once a Twig/Markdown transform references it, *anonymous* requests can repeatedly trigger memory exhaustion. So the trigger surface is effectively unauthenticated even though the setup is not; this makes repeated, low-effort availability disruption plausible once an attacker has any author-level foothold. EPSS is not provided in the input, KEV status is not listed (so not CISA-confirmed exploited), and no public POC is referenced, so exploitation signals are absent. Net: a real, actionable availability bug for Grav operators, but the authenticated-upload prerequisite keeps it below drop-everything urgency for most deployments.

An attacker who holds (or phishes/registers) a media-author account on a Grav site uploads a highly compressed oversized raster image (a 'decompression bomb'). They then publish content referencing a Twig or Markdown image transform so that GD or Imagick decodes the full uncompressed image without dimension checks; thereafter any anonymous visitor requesting that page forces the server to allocate massive memory, repeatedly crashing or hanging the site. No public exploit code is identified at time of analysis.