Resource Exhaustion Vulnerability in Grav by Get Grav
CVE-2026-112782

8.7HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112782?

Grav versions 1.7.53 prior to 1.7.53.5 and 2.0.0-rc.8 prior to 2.2.2 are susceptible to a resource exhaustion vulnerability. When the configuration option system.images.url_actions is activated, anonymous users can exploit this weakness to evade the system.images.max_pixels limitation. By manipulating image processing actions like forceResize and zoomCrop, attackers can prompt the Graphical Data (GD) library to allocate excessively large memory canvases, potentially causing server memory to be depleted and resulting in service outages.

Affected Version(s)

grav 2.0.0-rc.8 < 2.2.2

grav 1.7.53 < 1.7.53.5

grav 2.2.2

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-before-1.7.53.5...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.