All vulnerabilities
CVE-2026-112782GHSA-8gr9-59p6-r488

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

getgrav grav
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.2.2Also 1.7.53.5CVE List
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

Text from CVE List

Affected versions 4

  • gravaffected: 2.0.0-rc.8 before 2.2.2CVE List
  • gravunaffected: 2.2.2CVE List
  • gravaffected: 1.7.53 before 1.7.53.5CVE List
  • gravunaffected: 1.7.53.5CVE List

References 2