EUVD-2026-47759
GHSA-7983-35fr-8qwm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-delivered upload requires an authenticated user account (PR:L); GD OOM is availability-only with no confidentiality or integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
Articles & Coverage 1
AnalysisAI
Elgg's ImageService processes avatar uploads without validating source image dimensions prior to resizing, allowing authenticated users to trigger out-of-memory (OOM) conditions on the hosting server. All Elgg releases before 7.0.0 are affected; the fix introduced in 7.0.0 enforces hard limits on image height, width, and total resolution before any GD library resize operation is invoked. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the technique is conceptually trivial for any authenticated user with avatar upload access.
Technical ContextAI
Elgg is an open-source PHP social networking framework. The vulnerable code resides in engine/classes/Elgg/ImageService.php, specifically in the resize() and fixOrientation() methods, which invoke PHP's GD library to process uploaded images. CWE-770 (Allocation of Resources Without Limits or Throttling) describes the root cause precisely: GD allocates an uncompressed pixel buffer proportional to the image's width-times-height pixel count, regardless of the compressed file size on disk. A crafted image with extreme pixel dimensions - say 50,000 x 50,000 pixels - forces GD to allocate roughly 7.5 GB of RAM for a standard 24-bit image, exhausting server memory. The fix, confirmed in commit ab91d59dc2caaa3fdbfe7e9b916fc0cc7e6b323a, adds a new assertValidImageDimensions() method that calls PHP's getimagesize() before any resize operation and rejects images exceeding 10,000px height, 10,000px width, or 16,777,216 total pixels (16MP). These limits are also exposed as configurable settings ($CONFIG->image_resize_max_height, image_resize_max_width, image_resize_max_resolution) in elgg-config/settings.example.php. CPE cpe:2.3:a:elgg:elgg:*:*:*:*:*:*:*:* covers all versions prior to 7.0.0.
RemediationAI
Upgrade to Elgg 7.0.0 or later, which enforces image dimension validation via the new assertValidImageDimensions() method introduced in commit ab91d59dc2caaa3fdbfe7e9b916fc0cc7e6b323a (PR #15041 at https://github.com/Elgg/Elgg/pull/15041). Default limits in 7.0.0 are 10,000px maximum height, 10,000px maximum width, and 16,777,216 pixels (16MP) maximum total resolution, all configurable via $CONFIG->image_resize_max_height, $CONFIG->image_resize_max_width, and $CONFIG->image_resize_max_resolution. For sites unable to upgrade immediately, restricting upload file size at the web server layer (e.g., Nginx client_max_body_size or Apache LimitRequestBody) provides partial mitigation but does not fully prevent the attack, because a compressed PNG or TIFF can be very small on disk yet expand to an enormous pixel buffer - file size limits do not bound decompressed memory allocation. A more effective compensating control is to disable avatar uploads entirely for untrusted user roles, or to restrict account registration to verified users, which eliminates the PR:L attacker foothold. Note that no official Elgg security advisory URL beyond the GitHub PR was identified in the provided references.
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Rated high severity (CVSS 7.5),
elgg is vulnerable to Authorization Bypass Through User-Controlled Key. Rated medium severity (CVSS 5.9), this vulnerabi
elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remo
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows rem
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect. Rated medium severity (CVSS 6.1), this vulnerability i
Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject
engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today