CyberRota Analysis
AI-GeneratedGrav's file-based web platform is vulnerable to a denial-of-service attack, where an unauthenticated user can exploit oversized image requests to exhaust server memory and CPU resources. This can lead to significant performance degradation or service outages. Organizations using affected versions should prioritize upgrading to at least 1.7.53 or 2.0.0-rc.8 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8.