CVE-2026-53653

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8.

• CWE-770

• https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6
• https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174
• https://github.com/getgrav/grav/releases/tag/1.7.53
• https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8
• https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53645FOSSBilling is a free, open-source billing and client manage…8.5
• CVE-2026-53646FOSSBilling is a free, open-source billing and client manage…7.7
• CVE-2026-53647FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-53648FOSSBilling is a free, open-source billing and client manage…5.1
• CVE-2026-53649Joro is a web exploitation framework. Prior to version 1.1.1…9.6
• CVE-2026-5365The LatePoint plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2026-53654Grav is a file-based Web platform. Prior to 3.8.5, the Login…5.3
• CVE-2026-53655node-tar is a full-featured Tar for Node.js. Prior to 7.5.16…5.5
• CVE-2026-53656FiftyOne is an open-source platform for refining high-qualit…6.3
• CVE-2026-53657Lima launches Linux virtual machines, typically on macOS, fo…8.2
• CVE-2026-53658Fabric CA is a Certificate Authority for Hyperledger Fabric.…6.3
• CVE-2026-53659http4k is a functional toolkit for Kotlin HTTP applications.…7.5