CVE-2026-109324: Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with media-author permissions can upload a compressed oversized raster image and create a Twig or Markdown transform that causes it to be decoded. Anonymous users can then repeatedly request the affected page, contributing to continued unavailability.
What conditions are required for exploitation?
The attacker needs authenticated media-author access to upload the image and reference an image transform. Exploitation relies on GD or Imagick decoding the full source image without dimension checks.
What is the impact on affected sites?
The issue can exhaust server memory and make pages unavailable. The provided vector indicates no confidentiality or integrity impact, while availability impact is high.
How can I determine whether my deployment is affected?
Deployments running Grav before 2.1.7 are affected. Review whether media authors can upload raster images and whether Twig or Markdown image transforms process those uploads through GD or Imagick.