Executive brief
Elgg, an open-source social networking engine, is vulnerable to a denial-of-service attack. An authenticated user can upload a specially crafted, excessively large avatar image that exhausts server memory during the resizing process. This can lead to system crashes or significant performance degradation, impacting the availability of the platform for all users.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in Elgg's image handling component. The application fails to validate the pixel dimensions of uploaded avatar images before attempting to process them. An authenticated attacker can upload an image with extremely large dimensions, causing the server to encounter Out-of-Memory (OOM) errors during the resizing operation. This network-reachable attack requires low privileges (a standard user account) and results in a partial loss of availability. The issue is addressed in version 7.0.0 and backported to 6.3.5.
Affected products
- Elgg Elgg < 6.3.5, 7.0.0-rc.1 to < 7.0.0
Timeline
- 2026-04-16: patched: Fix merged into Elgg 7.0 branch
- 2026-07-22: disclosed: CVE published to NVD