Executive brief
Grav is a popular flat-file content management system used to build websites without a database. An unauthenticated attacker can crash the server by requesting images with extremely large resize dimensions, consuming gigabytes of RAM and CPU from a single request. A few concurrent requests can take an entire web host offline, causing service unavailability for all users.
Technical details
The vulnerability exists in Grav::fallbackUrl() (system/src/Grav/Common/Grav.php), which processes image transformation query parameters without validating dimension values. When a query parameter matches ImageMedium::$magic_actions, it calls the corresponding method (e.g., forceResize) with attacker-supplied dimensions. The GD image library's imagecreatetruecolor($w, $h) function allocates memory outside PHP's emalloc pool, bypassing PHP's memory_limit directive. An attacker can craft requests like `GET /image.png?forceResize=20000,20000` to force allocation of multi-gigabyte buffers. No authentication, plugin, or non-default configuration is required. The fix clamps numeric dimensions against a configurable ceiling (default 8000) before calling image manipulation functions.
Affected products
- GetGrav Grav < 1.7.53; >= 2.0.0-beta.1 and < 2.0.0-rc.8
Timeline
- 2026-06-16: disclosed: Published by GitHub Advisory Database
- 2026-08-14: advisory: Advisory reviewed and published to GitHub
- 2026-06-16: patched: Patches released: 1.7.53 and 2.0.0-rc.8