CVE-2026-53653: Unauthenticated Denial of Service via Unbounded Image Derivative Dimensions in Grav CMS

Vulnerability ID: CVE-2026-53653
CVSS Score: 8.7
Published: 2026-08-14

Grav CMS prior to version 1.7.53 and 2.0.0-rc.8 is vulnerable to an unauthenticated remote denial of service (DoS) vulnerability. By supplying crafted query parameters with extremely large dimensions to image assets, remote unauthenticated attackers can force the server to allocate massive amounts of system memory, leading to kernel Out-Of-Memory (OOM) termination of web worker processes.

TL;DR

Unauthenticated attackers can crash Grav CMS servers by appending extremely large resize parameters to image URLs, forcing the server's graphics library to allocate massive memory buffers until the process is killed.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-770
Attack Vector: Network (Unauthenticated)
CVSS v4.0 Score: 8.7 (High)
EPSS Score: 0.00301 (0.30% probability)
Impact: Denial of Service (OOM Crash)
Exploit Status: PoC / Theoretical
KEV Status: Not Listed

Affected Systems

Grav CMS 1.7.x
Grav CMS 2.0.x
Grav CMS: < 1.7.53 (Fixed in: 1.7.53)
Grav CMS: >= 2.0.0-beta.1, < 2.0.0-rc.8 (Fixed in: 2.0.0-rc.8)

Code Analysis

Commit: d9f9f03

Fix unbounded dynamic image manipulation in Grav 2.0.0-rc.8 branch

Commit: f4c0f42

Fix unbounded dynamic image manipulation in Grav 1.7.53 branch

Exploit Details

GitHub Security Advisory: Detailed explanation of the dynamic URL parameters vulnerability.

Mitigation Strategies

Disable dynamic URL image operations by setting system.images.url_actions to false.
Set strict limits on maximum allowed pixels via system.images.max_pixels.
Implement Web Application Firewall (WAF) rules to drop requests with excessive or non-standard image manipulation query strings.

Remediation Steps:

Open the system configuration file at system/config/system.yaml.
Locate the images configuration block.
Set url_actions to false.
If url_actions must be active, ensure system.images.max_pixels is configured to a safe baseline (e.g., 5000000 for 5 Megapixels).
Upgrade Grav CMS to version 1.7.53 or 2.0.0-rc.8 or higher.