Grav: Unauthenticated denial of service via unbounded image derivative dimensions
Priority MEDIUM 44CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed grav (getgrav): 2.0.0-rc.8, 1.7.53getgrav/grav (Packagist): 2.0.0-rc.8, 1.7.53
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getgrav | grav | 2.0.0-beta.1 to before 2.0.0-rc.8; before 1.7.53 | 2.0.0-rc.8, 1.7.53 | Patch available | CNA |
| — | getgrav/grav (Packagist) | 2.0.0-beta.1 to before 2.0.0-rc.8 | 2.0.0-rc.8 | Patch available | GHSA-4x9g-vw65-vvf9 |
| — | getgrav/grav (Packagist) | before 1.7.53 | 1.7.53 | Patch available | GHSA-4x9g-vw65-vvf9 |
- grav Vendorgetgrav Affected 2.0.0-beta.1 to before 2.0.0-rc.8; before 1.7.53 Fixed in 2.0.0-rc.8, 1.7.53 Patch available CNA
- getgrav/grav (Packagist) Vendor— Affected 2.0.0-beta.1 to before 2.0.0-rc.8 Fixed in 2.0.0-rc.8 Patch available GHSA-4x9g-vw65-vvf9
- getgrav/grav (Packagist) Vendor— Affected before 1.7.53 Fixed in 1.7.53 Patch available GHSA-4x9g-vw65-vvf9
Remediation
- Fix · CNA grav (getgrav) Fixed in 2.0.0-rc.8, 1.7.53
- Fix · GHSA-4x9g-vw65-vvf9 getgrav/grav (Packagist) Fixed in 2.0.0-rc.8 Advisory →
- Fix · GHSA-4x9g-vw65-vvf9 getgrav/grav (Packagist) Fixed in 1.7.53 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53653
- 2026-10-03 Alias added: GHSA-4x9g-vw65-vvf9
References
Other 6
- https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9
- https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6
- https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174
- https://github.com/getgrav/grav/releases/tag/1.7.53
- https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8
- https://github.com/getgrav/grav
More getgrav vulnerabilities
- TI-2026-30893 Grav: Privilege Escalation via Missing Server-Side Validation of groups/access CVSS 3.1CRITICAL 9.4
- TI-2025-28971 Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
- TI-2021-04523 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution CVSS 3.1CRITICAL 9.8
- TI-2026-50940 Grav CMS before 2.0.16 Origin Validation Bypass via Referer CVSS 4.0CRITICAL 9.3
- TI-2026-46446 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData CVSS 4.0CRITICAL 9.3
- TI-2021-22428 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-53653 · CVE Program
- CVE-2026-53653 · NVD
- FIRST EPSS
- GHSA-4x9g-vw65-vvf9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences