CVE-2026-109324

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-409

Impact

Authenticated media authors can exhaust server memory and trigger a denial of service by uploading compressed, oversized images that crash the site on decode. Once uploaded, subsequent anonymous visitors accessing the rendered image or page will repeatedly trigger the crash.

Root cause

Image processing via Twig or Markdown transforms passes images directly to GD or Imagick without checking dimensions before decoding.

Affected systems

Grav versions prior to 2.1.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade Grav to version 2.1.7 or later. As an interim workaround, restrict media upload permissions for untrusted accounts or disable Twig and Markdown image transforms.

shell

$ bin/gpm selfupgrade -y

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109324