CVE-2026-109324
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.