Summary
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down.
Details
Grav::fallbackUrl() (system/src/Grav/Common/Grav.php:800-804) loops over every query parameter and, when the name matches ImageMedium::$magic_actions, calls that method on the medium with the comma-split value as arguments:
foreach ($uri->query(null, true) as $action => $params) {
if (in_array($action, ImageMedium::$magic_actions, true)) {
call_user_func_array([&$medium, $action], explode(',', $params));
}
}
forceResize runs with force=true, so it sets the output size to the attacker's values with no clamp against the source or any ceiling. The getgrav/image GD adapter then calls imagecreatetruecolor($w, $h). libgd allocates that buffer outside PHP's emalloc, so memory_limit does not cap it. Grav exposes no system.images.max_width/max_height setting.
PoC
Any page that serves an image works. With a 200x150 source image:
GET /home/test.png?forceResize=20000,20000
Measured on PHP 8.4.21 with memory_limit=128M:
- peak worker RSS 3,109 MB
- 21.9 s CPU
- HTTP 200, 1.6 MB response
8000x8000 already needs ~244 MB. The cache key includes the dimensions, so varying them forces fresh work on every request.
Impact
Unauthenticated denial of service against any Grav site that serves images. No account, plugin, or non-default config required.
The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Clamp the request-derived dimensions before dispatch, behind a configurable cap. The image library is the wrong layer; bound the arguments at the request boundary.
--- a/system/src/Grav/Common/Grav.php
+++ b/system/src/Grav/Common/Grav.php
@@ public function fallbackUrl($path)
foreach ($uri->query(null, true) as $action => $params) {
if (in_array($action, ImageMedium::$magic_actions, true)) {
- call_user_func_array([&$medium, $action], explode(',', $params));
+ $args = explode(',', $params);
+ $max = (int) $config->get('system.images.max_dimension', 8000);
+ if ($max > 0
+ && in_array($action, ['resize', 'forceResize', 'cropResize', 'cropZoom', 'zoomCrop', 'crop'], true)) {
+ foreach ($args as $a) {
+ if (is_numeric($a) && (int) $a > $max) {
+ return false; // reject oversized derivative request
+ }
+ }
+ }
+ call_user_func_array([&$medium, $action], $args);
}
}
Document system.images.max_dimension (default 8000) so operators can tune it. A total-pixel ceiling (width * height) is a stricter alternative.
Frequently Asked Questions
- What is CVE-2026-53653? CVE-2026-53653 is a high-severity allocation of resources without limits or throttling vulnerability in getgrav/grav (composer), affecting versions >= 2.0.0-beta.1, < 2.0.0-rc.8. It is fixed in 2.0.0-rc.8, 1.7.53. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
- Which versions of getgrav/grav are affected by CVE-2026-53653? getgrav/grav (composer) versions >= 2.0.0-beta.1, < 2.0.0-rc.8 is affected.
- Is there a fix for CVE-2026-53653? Yes. CVE-2026-53653 is fixed in 2.0.0-rc.8, 1.7.53. Upgrade to this version or later.
- Is CVE-2026-53653 exploitable, and should I be worried? Whether CVE-2026-53653 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-53653 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-53653?
- Upgrade
getgrav/gravto 2.0.0-rc.8 or later - Upgrade
getgrav/gravto 1.7.53 or later
- Upgrade