CVE-2026-112782: falha de alta gravidade em getgrav grav
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.8%
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
getgrav · gravCVEs relacionadas — getgrav grav
No mesmo produto, das mais perigosas para as menos.
CVE-2024-27921HIGHGrav File Upload Path Traversal vulnerabilityEPSS 60.6%CVE-2021-29440HIGHTwig allowing dangerous PHP functions by defaultEPSS 29.9%CVE-2024-28116HIGHServer-Side Template Injection (SSTI) with Grav CMS security sandbox bypassEPSS 5.8%CVE-2026-61450HIGHGrav before 2.0.2 Config Exfiltration via offsetGet FilterEPSS 5.4%CVE-2023-34448HIGHGrav Server-side Template Injection (SSTI) via Twig Default FiltersEPSS 4.5%CVE-2026-42607CRITICALGrav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install FeatureEPSS 4.4%