p PatchFirst

CVE-2026-112782

CVE-2026-112782 · Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

CVSS 8.7 · High · EPSS 0.3% · Fix available

Published
Updated

Affected products and versions

  • grav

    Versions
    • ≥ 2.0.0-rc.8, < 2.2.2: Affected (semver)
    • 2.2.2: Not affected (semver)

    Update to 2.2.2

  • grav

    Versions
    • ≥ 1.7.53, < 1.7.53.5: Affected (custom)
    • 1.7.53.5: Not affected (custom)

    Update to 1.7.53.5

Original sources

Check your server →