DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-53653: CVE-2026-53653: Unauthenticated Denial of Service via Unbounded Image Derivative Dimensions in Grav CMS

#security #cve #cybersecurity

CVE-2026-53653: Unauthenticated Denial of Service via Unbounded Image Derivative Dimensions in Grav CMS

Vulnerability ID: CVE-2026-53653
CVSS Score: 8.7
Published: 2026-08-14

Grav CMS prior to version 1.7.53 and 2.0.0-rc.8 is vulnerable to an unauthenticated remote denial of service (DoS) vulnerability. By supplying crafted query parameters with extremely large dimensions to image assets, remote unauthenticated attackers can force the server to allocate massive amounts of system memory, leading to kernel Out-Of-Memory (OOM) termination of web worker processes.

TL;DR

Unauthenticated attackers can crash Grav CMS servers by appending extremely large resize parameters to image URLs, forcing the server's graphics library to allocate massive memory buffers until the process is killed.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network (Unauthenticated)
  • CVSS v4.0 Score: 8.7 (High)
  • EPSS Score: 0.00301 (0.30% probability)
  • Impact: Denial of Service (OOM Crash)
  • Exploit Status: PoC / Theoretical
  • KEV Status: Not Listed

Affected Systems

  • Grav CMS 1.7.x
  • Grav CMS 2.0.x
  • Grav CMS: < 1.7.53 (Fixed in: 1.7.53)
  • Grav CMS: >= 2.0.0-beta.1, < 2.0.0-rc.8 (Fixed in: 2.0.0-rc.8)

Code Analysis

Commit: d9f9f03

Fix unbounded dynamic image manipulation in Grav 2.0.0-rc.8 branch

Commit: f4c0f42

Fix unbounded dynamic image manipulation in Grav 1.7.53 branch

Exploit Details

Mitigation Strategies

  • Disable dynamic URL image operations by setting system.images.url_actions to false.
  • Set strict limits on maximum allowed pixels via system.images.max_pixels.
  • Implement Web Application Firewall (WAF) rules to drop requests with excessive or non-standard image manipulation query strings.

Remediation Steps:

  1. Open the system configuration file at system/config/system.yaml.
  2. Locate the images configuration block.
  3. Set url_actions to false.
  4. If url_actions must be active, ensure system.images.max_pixels is configured to a safe baseline (e.g., 5000000 for 5 Megapixels).
  5. Upgrade Grav CMS to version 1.7.53 or 2.0.0-rc.8 or higher.

References

Read the full report for CVE-2026-53653 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)