Vulnerability-Lookup

CVE-2026-53653 (GCVE-0-2026-53653)

Vulnerability from cvelistv5 – Published: 2026-07-10 16:12 – Updated: 2026-07-10 20:58

Title

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Summary

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 20:53 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav/commit/d9f9f0369a…	x_refsource_MISC
https://github.com/getgrav/grav/commit/f4c0f42eea…	x_refsource_MISC
https://github.com/getgrav/grav/releases/tag/1.7.53	x_refsource_MISC
https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
getgrav	grav	Affected: >= 2.0.0-beta.1, < 2.0.0-rc.8 Affected: < 1.7.53	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T20:53:11.243262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T20:58:50.005Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-beta.1, \u003c 2.0.0-rc.8"
            },
            {
              "status": "affected",
              "version": "\u003c 1.7.53"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T16:12:01.576Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9"
        },
        {
          "name": "https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6"
        },
        {
          "name": "https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174"
        },
        {
          "name": "https://github.com/getgrav/grav/releases/tag/1.7.53",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav/releases/tag/1.7.53"
        },
        {
          "name": "https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8"
        }
      ],
      "source": {
        "advisory": "GHSA-4x9g-vw65-vvf9",
        "discovery": "UNKNOWN"
      },
      "title": "Grav: Unauthenticated denial of service via unbounded image derivative dimensions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53653",
    "datePublished": "2026-07-10T16:12:01.576Z",
    "dateReserved": "2026-06-09T20:50:36.876Z",
    "dateUpdated": "2026-07-10T20:58:50.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53653",
      "date": "2026-09-29",
      "epss": "0.00524",
      "percentile": "0.42165"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "grav",
                "vendor": "getgrav",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0-beta.1, \u003c 2.0.0-rc.8"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 1.7.53"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8."
          }
        ],
        "id": "CVE-2026-53653",
        "lastModified": "2026-07-10T21:16:54.963",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-53653",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T20:53:11.243262Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-10T17:16:57.857",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/releases/tag/1.7.53"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-53653",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-10T20:53:11.243262Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-10T20:53:11.979Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "grav",
              "vendor": "getgrav",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0-beta.1, \u003c 2.0.0-rc.8"
                },
                {
                  "status": "affected",
                  "version": "\u003c 1.7.53"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-10T16:12:01.576Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9"
            },
            {
              "name": "https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6"
            },
            {
              "name": "https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174"
            },
            {
              "name": "https://github.com/getgrav/grav/releases/tag/1.7.53",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getgrav/grav/releases/tag/1.7.53"
            },
            {
              "name": "https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8"
            }
          ],
          "source": {
            "advisory": "GHSA-4x9g-vw65-vvf9",
            "discovery": "UNKNOWN"
          },
          "title": "Grav: Unauthenticated denial of service via unbounded image derivative dimensions"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-53653",
        "datePublished": "2026-07-10T16:12:01.576Z",
        "dateReserved": "2026-06-09T20:50:36.876Z",
        "dateUpdated": "2026-07-10T20:58:50.005Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53653

Vulnerability from fkie_nvd - Published: 2026-07-10 17:16 - Updated: 2026-07-10 21:16

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6
	security-advisories@github.com	https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174
	security-advisories@github.com	https://github.com/getgrav/grav/releases/tag/1.7.53
	security-advisories@github.com	https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8
	security-advisories@github.com	https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-beta.1, \u003c 2.0.0-rc.8"
            },
            {
              "status": "affected",
              "version": "\u003c 1.7.53"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8."
    }
  ],
  "id": "CVE-2026-53653",
  "lastModified": "2026-07-10T21:16:54.963",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53653",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-10T20:53:11.243262Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-10T17:16:57.857",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/releases/tag/1.7.53"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4X9G-VW65-VVF9

Vulnerability from github – Published: 2026-08-14 19:23 – Updated: 2026-08-14 19:23

Summary

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Details

Summary

An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down.

Details

Grav::fallbackUrl() (system/src/Grav/Common/Grav.php:800-804) loops over every query parameter and, when the name matches ImageMedium::$magic_actions, calls that method on the medium with the comma-split value as arguments:

foreach ($uri->query(null, true) as $action => $params) {
    if (in_array($action, ImageMedium::$magic_actions, true)) {
        call_user_func_array([&$medium, $action], explode(',', $params));
    }
}

forceResize runs with force=true, so it sets the output size to the attacker's values with no clamp against the source or any ceiling. The getgrav/image GD adapter then calls imagecreatetruecolor($w, $h). libgd allocates that buffer outside PHP's emalloc, so memory_limit does not cap it. Grav exposes no system.images.max_width/max_height setting.

PoC

Any page that serves an image works. With a 200x150 source image:

GET /home/test.png?forceResize=20000,20000

Measured on PHP 8.4.21 with memory_limit=128M:

peak worker RSS 3,109 MB
21.9 s CPU
HTTP 200, 1.6 MB response

8000x8000 already needs ~244 MB. The cache key includes the dimensions, so varying them forces fresh work on every request.

Impact

Unauthenticated denial of service against any Grav site that serves images. No account, plugin, or non-default config required.

Fix

Clamp the request-derived dimensions before dispatch, behind a configurable cap. The image library is the wrong layer; bound the arguments at the request boundary.

--- a/system/src/Grav/Common/Grav.php
+++ b/system/src/Grav/Common/Grav.php
@@ public function fallbackUrl($path)
                 foreach ($uri->query(null, true) as $action => $params) {
                     if (in_array($action, ImageMedium::$magic_actions, true)) {
-                        call_user_func_array([&$medium, $action], explode(',', $params));
+                        $args = explode(',', $params);
+                        $max = (int) $config->get('system.images.max_dimension', 8000);
+                        if ($max > 0
+                            && in_array($action, ['resize', 'forceResize', 'cropResize', 'cropZoom', 'zoomCrop', 'crop'], true)) {
+                            foreach ($args as $a) {
+                                if (is_numeric($a) && (int) $a > $max) {
+                                    return false; // reject oversized derivative request
+                                }
+                            }
+                        }
+                        call_user_func_array([&$medium, $action], $args);
                     }
                 }

Document system.images.max_dimension (default 8000) so operators can tune it. A total-pixel ceiling (width * height) is a stricter alternative.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-beta.1"
            },
            {
              "fixed": "2.0.0-rc.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.53"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-14T19:23:38Z",
    "nvd_published_at": "2026-07-10T17:16:57Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down.\n\n### Details\n`Grav::fallbackUrl()` (system/src/Grav/Common/Grav.php:800-804) loops over every query parameter and, when the name matches `ImageMedium::$magic_actions`, calls that method on the medium with the comma-split value as arguments:\n\n```php\nforeach ($uri-\u003equery(null, true) as $action =\u003e $params) {\n    if (in_array($action, ImageMedium::$magic_actions, true)) {\n        call_user_func_array([\u0026$medium, $action], explode(\u0027,\u0027, $params));\n    }\n}\n```\n\n`forceResize` runs with `force=true`, so it sets the output size to the attacker\u0027s values with no clamp against the source or any ceiling. The `getgrav/image` GD adapter then calls `imagecreatetruecolor($w, $h)`. libgd allocates that buffer outside PHP\u0027s `emalloc`, so `memory_limit` does not cap it. Grav exposes no `system.images.max_width`/`max_height` setting.\n\n### PoC\nAny page that serves an image works. With a 200x150 source image:\n\n```\nGET /home/test.png?forceResize=20000,20000\n```\n\nMeasured on PHP 8.4.21 with `memory_limit=128M`:\n\n- peak worker RSS 3,109 MB\n- 21.9 s CPU\n- HTTP 200, 1.6 MB response\n\n`8000x8000` already needs ~244 MB. The cache key includes the dimensions, so varying them forces fresh work on every request.\n\n### Impact\nUnauthenticated denial of service against any Grav site that serves images. No account, plugin, or non-default config required.\n\n## Fix\nClamp the request-derived dimensions before dispatch, behind a configurable cap. The image library is the wrong layer; bound the arguments at the request boundary.\n\n```diff\n--- a/system/src/Grav/Common/Grav.php\n+++ b/system/src/Grav/Common/Grav.php\n@@ public function fallbackUrl($path)\n                 foreach ($uri-\u003equery(null, true) as $action =\u003e $params) {\n                     if (in_array($action, ImageMedium::$magic_actions, true)) {\n-                        call_user_func_array([\u0026$medium, $action], explode(\u0027,\u0027, $params));\n+                        $args = explode(\u0027,\u0027, $params);\n+                        $max = (int) $config-\u003eget(\u0027system.images.max_dimension\u0027, 8000);\n+                        if ($max \u003e 0\n+                            \u0026\u0026 in_array($action, [\u0027resize\u0027, \u0027forceResize\u0027, \u0027cropResize\u0027, \u0027cropZoom\u0027, \u0027zoomCrop\u0027, \u0027crop\u0027], true)) {\n+                            foreach ($args as $a) {\n+                                if (is_numeric($a) \u0026\u0026 (int) $a \u003e $max) {\n+                                    return false; // reject oversized derivative request\n+                                }\n+                            }\n+                        }\n+                        call_user_func_array([\u0026$medium, $action], $args);\n                     }\n                 }\n```\n\nDocument `system.images.max_dimension` (default 8000) so operators can tune it. A total-pixel ceiling (`width * height`) is a stricter alternative.",
  "id": "GHSA-4x9g-vw65-vvf9",
  "modified": "2026-08-14T19:23:38Z",
  "published": "2026-08-14T19:23:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53653"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/releases/tag/1.7.53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav: Unauthenticated denial of service via unbounded image derivative dimensions"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53653 (GCVE-0-2026-53653)

FKIE_CVE-2026-53653

GHSA-4X9G-VW65-VVF9

Summary

Details

PoC

Impact

Fix

Tags

Sightings

Nomenclature

Related by attack behaviour