Grav CMS: Denial of service via image pixel limit bypass
Summary
Grav CMS versions 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contain a resource exhaustion vulnerability in the image processing. When system.images.url_actions is enabled, the system.images.max_pixels limit can be bypassed with single-dimension, percentage, zoomCrop or chained image actions. An anonymous visitor can send a short request that makes the GD library allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
Affected
- Grav 1.7.53 before 1.7.53.5
- Grav 2.0.0-rc.8 before 2.2.2
- Only sites with system.images.url_actions enabled are affected (default: disabled, unconfirmed by primary source).
Fixed in
- Grav 1.7.53.5
- Grav 2.2.2
Workaround
- Disable system.images.url_actions (inferred mitigation, not confirmed by a vendor source).
- Restrict image-generation requests with a reverse proxy or WAF rate limit (general practice).
Exploitation
- CVSS 8.7 (v4.0) per CVE record; vendor rates it Moderate.
- No known exploitation; not listed as known exploited in the sources reviewed. CISA KEV not directly checked.
- No public proof of concept found.
- Automatable: yes (CISA SSVC).
Our recommendation
- Check the installed Grav version and upgrade to 1.7.53.5 or 2.2.2.
- Check whether system.images.url_actions is enabled and whether it is needed; disable it if not.
- Read advisory GHSA-8gr9-59p6-r488 directly for the official version list.
- Monitor the server for memory exhaustion and check for public PoCs or KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8gr9-59p6-r488 github.com
- VulnCheck Advisory: Grav image pixel limit bypass www.vulncheck.com
- Grav Security Advisories github.com
- OpenCVE entry CVE-2026-112782 app.opencve.io
- OSV entry CVE-2026-112782 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:57.
Original description (NVD)
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.