Grav: Unauthenticated denial of service via unbounded image derivative dimensions
Summary
An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down.
Details
Grav::fallbackUrl() (system/src/Grav/Common/Grav.php:800-804) loops over every query parameter and, when the name matches ImageMedium::$magic_actions, calls that method on the medium with the comma-split value as arguments:
foreach ($uri->query(null, true) as $action => $params) {
if (in_array($action, ImageMedium::$magic_actions, true)) {
call_user_func_array([&$medium, $action], explode(',', $params));
}
}forceResize runs with force=true, so it sets the output size to the attacker's values with no clamp against the source or any ceiling. The getgrav/image GD adapter then calls imagecreatetruecolor($w, $h). libgd allocates that buffer outside PHP's emalloc, so memory_limit does not cap it. Grav exposes no system.images.max_width/max_height setting.
PoC
Any page that serves an image works. With a 200x150 source image:
GET /home/test.png?forceResize=20000,20000Measured on PHP 8.4.21 with memory_limit=128M:
- peak worker RSS 3,109 MB
- 21.9 s CPU
- HTTP 200, 1.6 MB response
8000x8000 already needs ~244 MB. The cache key includes the dimensions, so varying them forces fresh work on every request.
Impact
Unauthenticated denial of service against any Grav site that serves images. No account, plugin, or non-default config required.
Fix
Clamp the request-derived dimensions before dispatch, behind a configurable cap. The image library is the wrong layer; bound the arguments at the request boundary.
--- a/system/src/Grav/Common/Grav.php
+++ b/system/src/Grav/Common/Grav.php
@@ public function fallbackUrl($path)
foreach ($uri->query(null, true) as $action => $params) {
if (in_array($action, ImageMedium::$magic_actions, true)) {
- call_user_func_array([&$medium, $action], explode(',', $params));
+ $args = explode(',', $params);
+ $max = (int) $config->get('system.images.max_dimension', 8000);
+ if ($max > 0
+ && in_array($action, ['resize', 'forceResize', 'cropResize', 'cropZoom', 'zoomCrop', 'crop'], true)) {
+ foreach ($args as $a) {
+ if (is_numeric($a) && (int) $a > $max) {
+ return false; // reject oversized derivative request
+ }
+ }
+ }
+ call_user_func_array([&$medium, $action], $args);
}
}Document system.images.max_dimension (default 8000) so operators can tune it. A total-pixel ceiling (width * height) is a stricter alternative.
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| Composer-Paket | getgrav/grav | >= 2.0.0-beta.1, < 2.0.0-rc.8, < 1.7.53 | 2.0.0-rc.8, 1.7.53 |
Verweise
- https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9
- https://nvd.nist.gov/vuln/detail/CVE-2026-53653
- https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6
- https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174
- https://github.com/getgrav/grav
- https://github.com/getgrav/grav/releases/tag/1.7.53
- https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8
- CVSS-Vektor
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Schwäche (CWE)
CWE-770- Plattform
- Composer
- Paket
getgrav/grav- Veröffentlicht
- 14.08.2026
- Aktualisiert
- 11.10.2026 10:22
Quellen und Lizenzen
OSV / GitHub Advisory Database - GHSA-4x9g-vw65-vvf9 - CC BY 4.0
Schwachstellenhistorie: getgrav/grav
Alle veröffentlichten Schwachstellen dieses Pakets (Composer-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 99
- Erste → letzte
- 11.2019 09.2026
- Ohne Fix
- 6
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Kritisch 7
- Hoch 47
- Mittel 41
- Niedrig 4
Veröffentlichungen pro Jahr
- 2019: 1
- 2020: 1
- 2021: 4
- 2022: 10
- 2023: 5
- 2024: 8
- 2025: 23
- 2026: 47
-
Grav: Unauthenticated denial of service via unbounded image derivative dimensions dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.