CVE-2026-109324GHSA-h253-r5hw-95r5
Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms
getgrav grav
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.1.7gravCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.
Text from CVE List
Affected versions 2
- gravaffected: all versions before 2.1.7CVE List
- gravunaffected: 2.1.7CVE List