EUVD-2026-104588
GHSA-8fxw-crgg-h5h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public image-action URL as anonymous visitor
-
ExploitCraft forceResize/zoomCrop/chained action bypassing max_pixels
-
ExecutionGD allocates multi-gigabyte canvas
-
ImpactServer memory exhausted, site taken down
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Grav configuration setting system.images.url_actions to be enabled, which exposes URL-driven image manipulation to anonymous visitors; the attack specifically abuses single-dimension or percentage forceResize, zoomCrop, or chained image actions to bypass the system.images.max_pixels safeguard. Affected versions are Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2. The limiting factor is the url_actions configuration: deployments that leave URL image actions disabled are not exploitable. Where enabled, no authentication (PR:N) and no user interaction (UI:N) are needed, so any publicly reachable Grav instance with that setting is at risk. |
| Impact | This is a genuine, easily-reachable availability threat but confined to a single impact dimension. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated, no-interaction exploitation, and the description confirms this by naming 'anonymous visitors' as the attacker - so the preconditions for reaching the flaw are trivial. Impact is purely availability (VC:N/VI:N/VA:H): no data disclosure or integrity loss, only memory-exhaustion denial of service. The 8.7 score is therefore justified for a DoS but should not be read as system-compromise severity. Two important caveats temper real-world priority: (1) exploitation is gated on the non-default-looking configuration system.images.url_actions being enabled, so environments that leave URL-based image actions off are not exposed; and (2) no EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or at-scale exploitation. Net: a real, prioritizable issue for Grav operators who have url_actions enabled and expose image processing to anonymous users, but not an emergency on par with RCE or an actively-exploited bug. |
| Exploit ScenarioDerived | An anonymous attacker requests images through Grav's URL image-action endpoint, supplying single-dimension or percentage forceResize/zoomCrop parameters (or chaining multiple actions) that bypass the system.images.max_pixels guard. The PHP GD library is tricked into allocating multi-gigabyte canvases per request, and a handful of such requests exhausts server RAM and takes the site offline. No public exploit was identified at time of analysis, and no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Denial of service in Grav CMS 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 lets unauthenticated remote attackers exhaust server memory by bypassing the system.images.max_pixels safeguard when system.images.url_actions is enabled. Attackers use single-dimension or percentage forceResize, zoomCrop, or chained image actions to force PHP's GD library to allocate multi-gigabyte canvases and take the site down. No public exploit identified at time of analysis; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms this is an availability-only threat requiring the url_actions setting to be enabled.
RemediationAI
Vendor-released patch: upgrade to Grav 1.7.53.5 or 2.2.2 (or later). The fix is documented in the GitHub security advisory GHSA-8gr9-59p6-r488. If upgrading immediately is not possible, disable system.images.url_actions in the Grav configuration to remove anonymous URL-driven image manipulation; this eliminates exposure but will break legitimate features that rely on URL image actions. Alternatively, front the site with a WAF or reverse-proxy rule that rejects image action parameters containing forceResize, zoomCrop, or percentage-based sizing, but such rules may produce false positives for legitimate image requests. Setting system.images.max_pixels alone is insufficient because the vulnerability specifically bypasses that limit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a flat-file PHP CMS whose image pipeline can be driven by URL parameters when system.images.url_actions is enabled. The system.images.max_pixels setting is intended to cap the pixel count of generated images, but the validation logic can be bypassed by supplying only one dimension or by using percentages in forceResize, zoomCrop, or chained actions, so the computed canvas size never triggers the max_pixels check before PHP's GD extension allocates memory. This is CWE-400 (Uncontrolled Resource Consumption): an attacker controls image action parameters that translate into large GD canvas allocations. CPE entries cpe:2.3:a:getgrav:grav identify the affected product; the vulnerable code paths exist in Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2. Exploitation is conditional on url_actions being enabled, which exposes these URL-driven image transformations to anonymous visitors.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Anonymous remote attacker over HTTP with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is memory-exhaustion DoS only, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
Technical POC Analysis
CWE-400 (Uncontrolled Resource Consumption; the advisory also tags CWE-770, allocation without limits).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Grav CMS versions 1.7.53 through before 1.7.53.5 and 2.0.0-rc.8 through before 2.2.2 expose internet-facing sites to an unauthenticated denial-of-service condition that can exhaust server memory and take the site offline when image URL actions are enabled. Leadership should care because an attacker without credentials could disrupt customer access, revenue, and trust on public-facing Grav sites, especially where system.images.url_actions is enabled. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but the high-severity availability risk warrants immediate configuration controls.
No vendor-released patch identified at time of analysis; disable system.images.url_actions, restrict and rate-limit image action endpoints, block forceResize, zoomCrop, percentage/single-dimension, and chained image-action parameters at the WAF/reverse proxy, cap PHP memory and monitor GD canvas allocation, and take internet-facing instances offline if controls cannot be applied.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB