Read the docs
TI-2026-76621 Aliases CVE-2026-112782GHSA-8fxw-crgg-h5h4

Image pixel limit bypass in Grav allows denial of service

Priority MEDIUM 45CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Grav from 1.7.53 before 1.7.53.5 and from 2.0.0-rc.8 before 2.2.2 fails to enforce the system.images.max_pixels limit when system.images.url_actions is enabled. An anonymous visitor can send single-dimension or percentage forceResize, zoomCrop, or chained image actions, making GD allocate multi-gigabyte canvases (CWE-400). This exhausts server memory and takes the site down.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00758 55th percentileScored 2026-11-07
Fix Fixed grav (getgrav): 2.2.2, 1.7.53.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getgravgrav2.0.0-rc.8 to before 2.2.22.2.2Patch availableCNA
getgravgrav1.7.53 to before 1.7.53.51.7.53.5Patch availableCNA
  • grav Vendorgetgrav Affected 2.0.0-rc.8 to before 2.2.2 Fixed in 2.2.2 Patch available CNA
  • grav Vendorgetgrav Affected 1.7.53 to before 1.7.53.5 Fixed in 1.7.53.5 Patch available CNA

Remediation

Upgrade Grav 1.7.53 installations to 1.7.53.5 and Grav 2.0.0-rc.8 and later 2.x installations to 2.2.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA grav (getgrav) Fixed in 2.2.2
  • Fix · CNA grav (getgrav) Fixed in 1.7.53.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    getgrav grav 2.2.2

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-76620 Information disclosure in Grav exposes config secrets via form directivesPriority MEDIUM 45
    • TI-2026-76619 Allowlist bypass in Grav Flex Form lets editors call static methodsPriority MEDIUM 43
    Show all 3 records →

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112782
  2. 2026-10-20 Alias added: GHSA-8fxw-crgg-h5h4
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2026-30893 Grav: Privilege Escalation via Missing Server-Side Validation of groups/access CVSS 3.1CRITICAL 9.4
  • TI-2025-28971 Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2021-04523 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2026-50940 Grav CMS before 2.0.16 Origin Validation Bypass via Referer CVSS 4.0CRITICAL 9.3
  • TI-2026-46446 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData CVSS 4.0CRITICAL 9.3
  • TI-2021-22428 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) CVSS 4.0CRITICAL 9.3
See all 228 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences