Which versions of Grav CMS are affected by CVE-2026-53653?

Grav CMS versions prior to 1.7.53 and 2.0.0-rc.8 contain a resource exhaustion vulnerability enabling remote, unauthenticated users to crash or severely degrade affected servers through crafted image…. A patch is available.

Is there a public PoC exploit available for CVE-2026-53653?

Yes, a public proof-of-concept exploit is available for CVE-2026-53653. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-53653?

Within 24 hours: identify and document all Grav CMS deployments and their versions. Within 7 days: implement rate limiting on image processing endpoints (max 10 requests per minute per IP) and deploy WAF rules to block image requests with dimension parameters exceeding 5000 pixels. Within 30 days: monitor vendor advisories for patched versions; prepare upgrade procedures to Grav 1.7.53 or later (1.x branch) and 2.0.0 or later (2.x branch), executing immediately upon patch confirmation.

Grav CMS CVE-2026-53653

Q: What is the CVSS score of CVE-2026-53653?

CVE-2026-53653 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42943 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-10 GitHub_M

GHSA-4x9g-vw65-vvf9

Denial Of Service Grav Getgrav

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated request to a standard media endpoint (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion, so C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 18:01 EUVD

Analysis Generated

Jul 10, 2026 - 17:06 vuln.today

DescriptionCVE.org

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8.

AnalysisAI

Uncontrolled resource consumption in Grav flat-file CMS before 1.7.53 and 2.0.0-rc.8 lets a remote unauthenticated visitor crash or degrade a server by requesting on-the-fly image derivatives with absurdly large dimensions. Because Grav::fallbackUrl forwards URL query image actions such as forceResize straight to ImageMedium magic actions with no dimension or pixel ceiling, a single crafted request forces the server to allocate huge amounts of memory and CPU to build the derivative. No public exploit identified at time of analysis, but the attack is trivial and scriptable given the CVSS 4.0 VA:H, AV:N/AC:L/PR:N profile.

Technical ContextAI

Grav is a PHP-based flat-file content management system that generates responsive image variants (derivatives) at request time rather than pre-computing them. Its media pipeline exposes 'magic actions' on the ImageMedium object - chainable operations like resize, cropResize and forceResize - that can be triggered directly from URL query parameters. The vulnerable path is Grav::fallbackUrl, which handles requests for media assets and passes user-supplied parameters into these ImageMedium actions. Underlying image manipulation relies on PHP GD/Imagick, which must allocate an in-memory bitmap proportional to width × height × bytes-per-pixel; a request for, e.g., forceResize=60000,60000 forces the library to attempt to allocate billions of pixels. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the code accepts attacker-controlled target dimensions without validating them against a maximum width, height, or total-pixel budget before committing memory and CPU.

RemediationAI

Vendor-released patch: upgrade to Grav 1.7.53 (stable) or 2.0.0-rc.8 (2.0 pre-release), which introduce dimension/pixel ceilings on ImageMedium actions reached through Grav::fallbackUrl; the fix commits are d9f9f0369a07ae5c96cde700c7949e1237b29cf6 and f4c0f42eea755cedad6f626b342c88d4cba72174. If you cannot upgrade immediately, place a reverse proxy or WAF rule in front of the site to reject media requests whose image-action query parameters (forceResize, resize, cropResize, etc.) contain dimensions above a sane threshold (for example, deny any width or height over a few thousand pixels), and cap PHP resources via php.ini memory_limit and max_execution_time so a single request cannot consume the whole host - the trade-off is that legitimate very-large derivative requests will also be blocked or truncated. As additional hardening, front image derivatives with an on-disk cache/CDN and rate-limit unauthenticated requests to the media endpoint, accepting the added infrastructure and slight first-render latency. Consult the advisory at https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9 before rolling out workarounds.