CVE-2026-109324
Deferred Deferred - Pending Action

Memory Exhaustion in Grav CMS via Oversized Image Upload

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109324
EUVD
EUVD-2026-97626

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Grav before 2.1.7 has a denial of service vulnerability where authenticated media authors can upload compressed oversized raster images. When these images are referenced in Twig or Markdown transforms, GD or Imagick decodes the full image without checking dimensions, causing memory exhaustion. This leads to page unavailability for all users.

Detection Guidance

Check Grav version with 'bin/grav version' or inspect system logs for repeated memory exhaustion errors during image processing. Monitor for high memory usage spikes when image transforms are triggered via Twig or Markdown.

Impact Analysis

This vulnerability allows attackers to make Grav websites unavailable by repeatedly triggering memory exhaustion. Users may experience slow page loads or complete site downtime. Confidentiality and integrity of data are not affected.

Mitigation Strategies

Upgrade Grav to version 2.1.7 or later. Configure system.images.max_pixels to limit image dimensions during transforms. Disable image transforms in untrusted contexts until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart