Grav CMS CVE-2026-53653

Exploitation requires that the target run a Grav site (before 1.7.53 / 2.0.0-rc.8) that serves dynamically generated image derivatives, and that the attacker can reach the media/image URL and append image-action query parameters such as forceResize, resize, or cropResize processed by Grav::fallbackUrl through ImageMedium magic actions - these actions are part of Grav's standard media handling, so no non-default feature toggle is needed. No authentication, no user interaction, and no special privileges are required (CVSS PR:N/UI:N). Limiting factors that reduce real-world risk: sites that serve only pre-generated/static images or place all derivatives behind a CDN/cache may not reach the vulnerable code path on demand, upstream php.ini memory_limit/max_execution_time caps bound the blast radius of each request, and a WAF filtering oversized dimension parameters neutralizes the trivial variant.

The signals are internally consistent and point to a genuine, easy-to-abuse availability threat rather than an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:N/VA:H, base 8.7) correctly captures a network-reachable, low-complexity, unauthenticated attack whose only impact is availability - no data confidentiality or integrity exposure. CWE-770 plus the 'oversized dimensions' description means exploitation is deterministic and automatable: no memory grooming, race, or auth needed. EPSS and CISA KEV data were not provided in the input, so exploitation probability and active-exploitation status are unknown; the absence of a KEV entry means there is no confirmation of in-the-wild use, and no POC was referenced. Net priority is elevated for internet-facing Grav instances that serve dynamic image derivatives, because a single unauthenticated request can degrade or exhaust a shared web server, but it is not a data-breach-class issue. Missing signal to flag: no EPSS score and no KEV status in the source data - do not treat this as actively exploited absent that confirmation.

An attacker discovers any image served by a target Grav site and appends an image-action query such as forceResize with enormous width and height values, then replays that request repeatedly or from multiple sources. Each request forces the server to allocate a massive bitmap through PHP GD/Imagick, spiking memory and CPU until worker processes are killed or the host becomes unresponsive, denying service to legitimate users. The attack requires no authentication or user interaction and is trivial to script; no public POC was referenced in the source data.