Quick answers
- Is CVE-2026-112782 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-112782 being exploited in the wild.
- How severe is CVE-2026-112782?
- High severity, with a CVSS score of 7.5, published 19 October 2026.
- Which products and versions are affected?
- Grav 1.7.53 before 1.7.53.5, 2.0.0-rc.8 before 2.2.2.
- Is there a fix for CVE-2026-112782?
- Yes: fixed in Grav 1.7.53.5, 2.2.2. Until then: Turn system.images.url_actions off, or ensure the migrate-grav plugin does not enable it during site migration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-112782 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-112782?
- Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Grav 1.7.53.5, 2.2.2
Turn system.images.url_actions off, or ensure the migrate-grav plugin does not enable it during site migration.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400/770) in Grav's image processing when system.images.url_actions is enabled. The max_pixels limit check failed to account for derived dimensions, percentages, zoomCrop intermediate canvases, and chained actions, allowing an unauthenticated attacker to force GD to allocate multi-gigabyte canvases via crafted query strings like ?forceResize=46000 or ?zoomCrop=46000,1. Each new size bypasses the derivative cache, and memory allocation occurs outside PHP's memory_limit on systems linking system libgd.
Affected products
- Grav Grav 1.7.53 before 1.7.53.5, 2.0.0-rc.8 before 2.2.2
Timeline
- 2026-10-05: disclosed
- 2026-10-19: advisory