Denial of Service Vulnerability in Grav by Getgrav
CVE-2026-109324

7.1HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109324?

Grav before version 2.1.7 is susceptible to a denial of service vulnerability that enables authenticated media authors to deplete server memory through the uploading of excessively large compressed raster images. This flaw allows attackers to exploit Twig or Markdown transforms, leading to ImageMagick or GD processing these images without appropriate dimension validation. Consequently, unauthorized requests could trigger continuous page inaccessibility, severely affecting server performance and user experience.

Affected Version(s)

grav 0 < 2.1.7

grav 2.1.7

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-before-2.1.7-me...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.