CVE-2026-109324: Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

Q: Who can exploit this issue?

An authenticated user with media-author permissions can upload a compressed oversized raster image and create a Twig or Markdown transform that causes it to be decoded. Anonymous users can then repeatedly request the affected page, contributing to continued unavailability.

Q: What conditions are required for exploitation?

The attacker needs authenticated media-author access to upload the image and reference an image transform. Exploitation relies on GD or Imagick decoding the full source image without dimension checks.

Q: What is the impact on affected sites?

The issue can exhaust server memory and make pages unavailable. The provided vector indicates no confidentiality or integrity impact, while availability impact is high.

Q: How can I determine whether my deployment is affected?

Deployments running Grav before 2.1.7 are affected. Review whether media authors can upload raster images and whether Twig or Markdown image transforms process those uploads through GD or Imagick.

Published Oct 12, 2026

Updated

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.

Affected Software

1 affected component

Grav Grav<2.1.7

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with media-author permissions can upload a compressed oversized raster image and create a Twig or Markdown transform that causes it to be decoded. Anonymous users can then repeatedly request the affected page, contributing to continued unavailability.

What conditions are required for exploitation?

The attacker needs authenticated media-author access to upload the image and reference an image transform. Exploitation relies on GD or Imagick decoding the full source image without dimension checks.

What is the impact on affected sites?

The issue can exhaust server memory and make pages unavailable. The provided vector indicates no confidentiality or integrity impact, while availability impact is high.

How can I determine whether my deployment is affected?

Deployments running Grav before 2.1.7 are affected. Review whether media authors can upload raster images and whether Twig or Markdown image transforms process those uploads through GD or Imagick.

CVE-2026-109324: Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

What is the impact on affected sites?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

What is the impact on affected sites?

How can I determine whether my deployment is affected?