Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-53653Grav: Unauthenticated denial of service via unbounded image derivative dimensions

High 8.7

In plain English

A high-severity resource allocation without limits in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	2.0.0-rc.8	GHSA-4x9g-vw65-vvf9
Packagist	getgrav/grav	1.7.53	GHSA-4x9g-vw65-vvf9

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	>= 2.0.0-beta.1, < 2.0.0-rc.8< 1.7.53

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9 x_refsource_CONFIRM
https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6 x_refsource_MISC
https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174 x_refsource_MISC
https://github.com/getgrav/grav/releases/tag/1.7.53 x_refsource_MISC
https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8 x_refsource_MISC