Grav versions before 2.1.7 contain a memory exhaustion flaw that is triggered by uploaded compressed raster images that are larger than expected. When a media author uploads such an image, the image transform functions in Twig or Markdown process the file using GD or Imagick without checking the dimensions of the decoded image. This allows the attacker to consume large amounts of memory, ultimately causing the web server to become unresponsive or crash. The vulnerability is limited to a denial of service; it does not provide code execution or privilege escalation.

The affected product is the Grav content‑management system provided by getgrav, in all releases earlier than 2.1.7. Authenticated users with media‑author privileges can supply oversized images, while the same flaw can be exercised by anonymous users who trigger a Twig or Markdown transform that processes the image.

The CVSS score of 7.1 indicates a moderate to high risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the flaw is not listed in CISA’s KEV catalog. Attackers do not need elevated rights beyond media‑author roles, and anonymous requests can repeatedly trigger the transform path, making the vulnerability a realistic threat to site availability. Defensive measures are needed to prevent a sustained denial of service.