CVE-2026-112782 in Grav
Summary
by MITRE • 10/19/2026
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Grav versions prior to 1.7.53.5 and 2.0.2 involves a critical resource exhaustion flaw within its image processing subsystem. This issue specifically arises when the configuration parameter system.images.url_actions is enabled, which allows users to manipulate images via URL parameters without authentication. The core technical failure lies in how the application handles specific resize operations such as forceResize, zoomCrop, and chained actions. When an attacker supplies dimensions specified as percentages or single values that are excessively large relative to the intended output, the underlying GD library allocates a canvas memory buffer based on these unvalidated inputs rather than enforcing the configured system.images.max_pixels limit effectively during the initial allocation phase.
This misconfiguration leads to a severe denial of service condition through resource exhaustion. By crafting requests with maliciously sized parameters, an attacker can force the server's PHP process to allocate multi-gigabyte memory blocks for image canvases. Since GD attempts to load and manipulate these massive images in RAM, it quickly consumes all available system memory or hits PHP memory limits, causing the application to crash or become unresponsive. This allows anonymous visitors, who do not require any form of authentication, to trigger this behavior easily by simply modifying URL parameters, thereby taking down the entire website for all users and disrupting service availability.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-787, Out-of-bounds Write, if the memory allocation leads to buffer overflows in lower-level libraries. In terms of attack vectors, it falls under ATT&CK technique T1496, Resource Hijacking, where an attacker uses computing resources for their own purposes or causes a denial of service by exhausting system capacity. The lack of input validation on percentage-based dimensions and the failure to cap canvas sizes before memory allocation are key indicators of this flaw.
To mitigate this vulnerability, administrators must upgrade Grav to version 1.7.53.5 or later, or version 2.0.2 for the development branch, as these releases include patches that properly enforce pixel limits during image processing operations regardless of how dimensions are specified. Additionally, until an upgrade is performed, it is advisable to disable system.images.url_actions if remote manipulation of images via URL parameters is not strictly required by the application's functionality. Implementing web application firewall rules that restrict unusually large dimension values in query strings can also provide a temporary layer of defense against exploitation attempts targeting this specific resource exhaustion vector.