Technical impact
The flaw allows an unauthenticated visitor to request image derivatives with arbitrarily large dimensions via URL query parameters such as forceResize. Since Grav passes these dimensions directly to the image handling library without an upper bound, the requested image eventually exhausts resources and causes the application to become unresponsive. The weakness is a classic resource‑exhaustion flaw, identified as CWE‑770.
Affected Systems
Grav content‑management systems before version 1.7.53 and before 2.0.0‑rc.8 are impacted. Site owners running any of those older releases are vulnerable to this denial‑of‑service attack when faced with untrusted traffic that triggers large image derivative requests.
Risk and Exploitability
The CVSS score of 8.7 places the vulnerability in the high‑severity category, while the EPSS score of <1% indicates a very low but non‑zero exploitation probability. Based on the description, it is inferred that the attacker can trigger the vulnerability by sending an unauthenticated HTTP request containing large dimensions to image processing endpoints, which will compel the server to generate excessively large images and exhaust memory and CPU. The attack vector is straightforward and does not require privileged access, and the vulnerability is not listed in the CISA KEV catalog, but the severity and ease of exploitation render it a significant risk for any publicly exposed Grav installation.
Github GHSA