CVE-2026-53653: Grav denial of service via unbounded image resizing

CVE-2026-53653 · Severity: high · CVSS 4 · Published 2026-07-10

Grav is a popular flat-file content management system used to build websites without a database. An unauthenticated attacker can crash the server by requesting images with extremely large resize dimensions, consuming gigabytes of RAM and CPU from a single request. A few concurrent requests can take an entire web host offline, causing service unavailability for all users.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-53653 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53653 being exploited in the wild.
How severe is CVE-2026-53653?
High severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
Grav < 1.7.53; getgrav/grav (Packagist) ECOSYSTEM:introduced=2.0.0-beta.1,fixed=2.0.0-rc.8.
Is there a fix for CVE-2026-53653?
Yes. getgrav/grav (Packagist): upgrade to 2.0.0-rc.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53653 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-53653?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.0-rc.8 or later
    composer require getgrav/grav:^2.0.0-rc.8

Technical details

The vulnerability exists in Grav::fallbackUrl() (system/src/Grav/Common/Grav.php), which processes image transformation query parameters without validating dimension values. When a query parameter matches ImageMedium::$magic_actions, it calls the corresponding method (e.g., forceResize) with attacker-supplied dimensions. The GD image library's imagecreatetruecolor($w, $h) function allocates memory outside PHP's emalloc pool, bypassing PHP's memory_limit directive. An attacker can craft requests like `GET /image.png?forceResize=20000,20000` to force allocation of multi-gigabyte buffers. No authentication, plugin, or non-default configuration is required. The fix clamps numeric dimensions against a configurable ceiling (default 8000) before calling image manipulation functions.

Affected products

  • GetGrav Grav < 1.7.53; >= 2.0.0-beta.1 and < 2.0.0-rc.8

Identifiers

  • CVE-2026-53653
  • GHSA-4x9g-vw65-vvf9

Timeline

  • 2026-06-16: disclosed: Published by GitHub Advisory Database
  • 2026-08-14: advisory: Advisory reviewed and published to GitHub
  • 2026-06-16: patched: Patches released: 1.7.53 and 2.0.0-rc.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.