# CVE-2026-112782: Grav image pixel limit bypass allows resource exhaustion

Source: https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112782 · Severity: high · CVSS 7.5 · Published 2026-10-19

Grav is a file-based content management system. When image URL actions are enabled—which is off by default but turned on by a migration plugin—attackers can craft requests that cause the server to allocate gigabytes of memory, crashing the website and affecting other services on the same host.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-112782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112782 being exploited in the wild.

**How severe is CVE-2026-112782?** High severity, with a CVSS score of 7.5, published 19 October 2026.

**Which products and versions are affected?** Grav 1.7.53 before 1.7.53.5, 2.0.0-rc.8 before 2.2.2.

**Is there a fix for CVE-2026-112782?** Yes: fixed in Grav 1.7.53.5, 2.2.2. Until then: Turn system.images.url_actions off, or ensure the migrate-grav plugin does not enable it during site migration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112782 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112782?** Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Grav 1.7.53.5, 2.2.2

Turn system.images.url_actions off, or ensure the migrate-grav plugin does not enable it during site migration.

## Technical details

The vulnerability is a resource exhaustion flaw (CWE-400/770) in Grav's image processing when system.images.url_actions is enabled. The max_pixels limit check failed to account for derived dimensions, percentages, zoomCrop intermediate canvases, and chained actions, allowing an unauthenticated attacker to force GD to allocate multi-gigabyte canvases via crafted query strings like ?forceResize=46000 or ?zoomCrop=46000,1. Each new size bypasses the derivative cache, and memory allocation occurs outside PHP's memory_limit on systems linking system libgd.

## Affected products

- Grav Grav 1.7.53 before 1.7.53.5, 2.0.0-rc.8 before 2.2.2

## Timeline

- 2026-10-05: disclosed
- 2026-10-19: advisory

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-8gr9-59p6-r488](https://github.com/getgrav/grav/security/advisories/GHSA-8gr9-59p6-r488)
- [https://www.vulncheck.com/advisories/grav-before-1.7.53.5-and-2.2.2-image-pixel-limit-bypass-denial-of-service](https://www.vulncheck.com/advisories/grav-before-1.7.53.5-and-2.2.2-image-pixel-limit-bypass-denial-of-service)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)
- [Grav Clockwork profiler authentication bypass in loopback check](https://junglewise.ai/threats/cve-2026-109325-grav-from-2-0-22-before-2-1-7-contains-an-authentication-bypass)