Grav CMS Image Processing Flaw Allows Remote Memory Exhaustion Attacks
Unauthenticated users can trigger resource exhaustion in Grav CMS versions below 2.2.2 by manipulating image resize parameters, leading to potential site outages.
Key points
- The vulnerability affects Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2.
- Attackers exploit the image processing engine to allocate multi-gigabyte memory canvases.
- The flaw is rated High severity with a CVSS score of 8.7 by the National Vulnerability Database.
A resource exhaustion vulnerability in the Grav content management system allows anonymous visitors to crash web servers. The flaw enables attackers to bypass system limits on image pixel dimensions when specific URL actions are enabled.
What happened
The National Vulnerability Database recorded CVE-2026-112782 as a high-severity issue with a CVSS score of 8.7. The flaw exists in Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2. According to the NVD record, the vulnerability stems from how the system handles image processing requests.
When the system.images.url_actions setting is enabled, the application fails to properly enforce the system.images.max_pixels limit. This configuration allows external users to send manipulated image requests without authentication. Attackers can use single-dimension or percentage-based forceResize, zoomCrop, or chained image actions to trigger the exploit.
These malicious requests instruct the GD graphics library to allocate extremely large memory canvases. The source material indicates that these allocations can reach multi-gigabyte sizes. This rapid consumption of server memory leads to resource exhaustion. The resulting state prevents the web server from serving legitimate traffic, effectively taking the site down.
Why it matters
Security operations teams must recognize that this vulnerability requires no authentication. Anonymous visitors can trigger the memory exhaustion by simply crafting specific URLs. The impact is immediate denial of service through resource starvation rather than data theft.
The affected versions cover a wide range of Grav installations. Teams running any version before 1.7.53.5 or before 2.2.2 are exposed. The vulnerability is particularly dangerous because it leverages standard image processing features. Organizations that enable dynamic image resizing for performance or user experience are at highest risk.
Our take on the response
- Verify if system.images.url_actions is enabled in your Grav configuration files.
- Check server logs for unusual spikes in memory usage during image processing requests.
- Identify any instances of forceResize or zoomCrop parameters in recent web access logs.
- Review current Grav versions against the affected ranges listed in the NVD record.
What defenders should look for
Teams usually detect this activity by monitoring for sudden, unexplained increases in server memory consumption. Security alerts should trigger when the GD library or image processing modules consume excessive resources. Defenders should check web access logs for repeated requests containing image manipulation parameters like forceResize or zoomCrop. Containment moves typically involve disabling the vulnerable URL action feature temporarily. Operations teams should also look for patterns of anonymous requests targeting image endpoints. Blocking suspicious source IPs may help mitigate the immediate impact while a permanent fix is applied.
What to do and how to stay safe: Grav
- Audit your Grav installations to confirm they are running version 1.7.53.5 or higher, or 2.2.2 or higher.
- Disable the system.images.url_actions setting if dynamic image processing via URL is not strictly required for your workflow.
- Implement rate limiting on endpoints that handle image processing requests to reduce the impact of rapid-fire exploitation attempts.
- Monitor server memory usage metrics closely for anomalies that correlate with image processing activity, especially from unauthenticated sources.
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Grav are affected by CVE-2026-112782?
The vulnerability affects Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates the vulnerability as High with a CVSS score of 8.7.
How do attackers exploit this vulnerability?
Attackers send specific image action requests that bypass pixel limits, causing the server to allocate large memory canvases.
