CVE-2026-109324 getgrav CVE debrief

Who should care

System administrators and security teams responsible for Grav installations, particularly those with public-facing sites or applications, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-109324 is a high-severity vulnerability in Grav that allows authenticated users to cause memory exhaustion through oversized image uploads. Defenders should prioritize remediation, especially for public-facing sites, and verify affected versions and deployments.

• Potential for repeated denial-of-service attacks through anonymous requests
• Memory exhaustion leading to system resource depletion
• Possible impact on system availability and user experience
• Need for verification of affected versions and deployment contexts

Technical summary

The vulnerability allows authenticated media authors to exhaust memory by uploading compressed oversized raster images, which can be decoded without dimension checks via Twig or Markdown transforms. This can cause page unavailability through repeated anonymous requests. The vulnerability affects Grav versions before 2.1.7 and has a CVSS score of 7.1. Defenders should prioritize remediation, especially for public-facing sites, and verify affected versions and deployments. Additional mitigations include restricting image uploads to authenticated users and implementing monitoring for unusual traffic patterns and system resource utilization.

Defensive priority

Medium

Recommended defensive actions

• Review and update Grav installations to version 2.1.7 or later
• Restrict image uploads to authenticated users
• Implement monitoring for unusual traffic patterns and system resource utilization
• Consider applying compensating controls, such as rate limiting or IP blocking
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on affected deployments and potential mitigations is limited. Defenders should verify affected versions and deployments, review system resource utilization, and monitor for unusual traffic patterns. The vulnerability allows authenticated media authors to exhaust memory by uploading compressed oversized raster images, which can be decoded without dimension checks via Twig or Markdown transforms.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.