CVE-2026-112782

HighCVSS 7.5/10Last modified Oct 20, 2026

Description

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1127834.3OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-CVE-2026-1127844.3OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to se CVE-2026-1127854.3OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate s CVE-2026-1127865.4OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated CVE-2026-1127874.3OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view CVE-2026-112798.8Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-11284.3The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to mak CVE-2026-112804.3Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a CVE-2026-112815.0Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive i CVE-2026-112829.6Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform CVE-2026-1128208.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Acade CVE-2026-1128216.5Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.Th