CVE-2026-109324

Executive Summary

CVE-2026-109324 is a denial of service vulnerability in the Grav flat-file content management system affecting all versions prior to 2.1.7. An authenticated user with media author privileges can upload compressed oversized raster images that, when referenced through a Twig or Markdown transform, cause GD or Imagick to decode the full source image without dimension checks — exhausting server memory. Because the resulting memory pressure is triggered by otherwise ordinary image rendering requests, unauthenticated visitors can repeatedly cause page unavailability by simply requesting the affected content.

The vulnerability carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a network-reachable, low-complexity attack that degrades availability while requiring low privilege (a valid media author account) to plant the payload. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the flaw is assessed as UNPATCHED across all tracked patch sources (patch confidence 0/4), with no EPSS score assigned by FIRST.org and no CISA KEV listing. Organizations running self-hosted Grav with multi-author or delegated content workflows should treat this as a live availability risk.

Technical Analysis

Grav is a flat-file CMS in which content is authored as Markdown files and rendered through the Twig templating engine. Grav includes an integrated media subsystem that allows image and media assets to be uploaded and referenced directly from page content, and it exposes media transformation capabilities — resizing, cropping, and related manipulations — that can be invoked from Twig templates or from Markdown image references. These transformations are backed by the PHP GD extension or the Imagick extension, whichever is available in the host environment.

The root cause is classified as CWE-409: Improper Handling of Highly Compressed Data (Data Amplification). The vulnerability arises when Grav processes a raster image through a Twig or Markdown transform. According to the NVD description, the affected code path decodes the full source image using GD or Imagick without performing dimension checks on the incoming file. This is the classic "decompression bomb" or "image bomb" pattern: a highly compressed raster file (for example, a large-canvas image that compresses to a very small on-disk size) expands to an enormous in-memory bitmap the moment a decoder materializes its pixel buffer. A file that is trivial to store and transmit can demand orders of magnitude more memory when decoded.

The attack surface is the media upload and rendering pipeline:

1. Upload surface — Authenticated media authors can place image files into the site's media/content storage. Grav's media author role is explicitly implicated in the description, meaning the attacker does not need administrative rights, only the ability to contribute media.
2. Decode surface — When page content references the uploaded asset through a Twig or Markdown transform, Grav hands the file to GD or Imagick for processing. Because no dimension or pixel-count preflight occurs, the decoder allocates memory proportional to the decoded image's full dimensions rather than its compressed size.
3. Amplification surface — Markdown content is rendered whenever the page is served. The stored transform reference therefore acts as a persistent trigger: each request that renders the page re-invokes the decoder, repeatedly re-consuming memory.

There are two distinct privilege levels in the chain. Planting the malicious media requires an authenticated media author account (PR:L in the CVSS vector). Triggering the memory exhaustion, however, does not — the NVD description states that anonymous requests can repeatedly cause page unavailability. This asymmetry is what makes the flaw operationally significant: a single low-privileged author can create a denial of service that any unauthenticated visitor can activate at will, turning a content contribution into a sustained availability weapon.

The interaction with the web server process model compounds the risk. PHP applications served via mod_php, PHP-FPM, or similar typically operate with a configured memory_limit and a bounded worker pool. Decoding an image bomb can drive a worker into memory exhaustion, result in a fatal out-of-memory error, or force the worker to be recycled while other requests queue. When the same page is requested concurrently, multiple workers can be driven into the same state, collapsing effective concurrency and producing sustained page unavailability rather than a transient error.

No specific source file paths, function names, or class names beyond those stated in the NVD description (Twig, Markdown, GD, Imagick) are asserted here. The precise implementation location of the missing dimension check is not disclosed in the available intelligence, and no patch diff is available to confirm it. The vulnerability is described at the level of its mechanism: a missing preflight dimension check on decoded image data within the media transformation path.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-109324. The attack chain below is inferred from the vulnerability class (CWE-409 data amplification via image decoding) and the specific behaviors described in the NVD entry. No specific code patterns, endpoint paths, function names, or parameter names are asserted, because none are disclosed in the source intelligence.

1. Reconnaissance and target identification. The attacker identifies a Grav-powered site, typically by fingerprinting the CMS through its characteristic asset and content directory structure and page rendering behavior. A prerequisite for the full chain is that the attacker can obtain a media author account — either through legitimate provisioning (a multi-author editorial site, a community platform, a hosted Grav deployment that permits self-registration of contributors), through credential compromise, or through a site that grants media upload rights broadly. The attacker also benefits from knowing whether the backend uses GD or Imagick, since decode behavior and memory characteristics differ, but neither backend blocks the attack per the description.

2. Triggering the flaw class. Using the media author account, the attacker uploads a crafted compressed oversized raster image. The defining property is a high compression ratio against a large declared canvas: a file that is small on disk but that expands to a very large pixel buffer when decoded. Because Grav performs no dimension check prior to decoding in the affected path, the file passes into storage without tripping a size guard based on decoded dimensions.

3. Payload delivery and invocation. The attacker then publishes or edits content that references the uploaded asset through a Twig or Markdown image transform, causing Grav to route the asset through GD or Imagick for processing. Critically, the transform reference is now embedded in rendered page content. From this point forward, the attacker no longer needs an authenticated session: any anonymous request that causes the page to render re-invokes the transform and re-triggers the full-source decode. The NVD description explicitly notes that "anonymous requests" can "repeatedly cause page unavailability," so the denial of service is self-sustaining from the stored trigger rather than requiring ongoing attacker interaction.

4. Post-exploitation impact. The repeated decodes exhaust server memory. Depending on the deployment, this manifests as PHP worker fatal out-of-memory errors, worker pool starvation, elevated response latency, HTTP 500/502 responses, or complete page unavailability for the affected content and potentially for co-tenant pages on the same worker pool. Because triggering requires no authentication and no specialized tooling — only repeated ordinary HTTP requests to the poisoned page — the barrier to sustaining the outage is very low. There is no confidentiality or integrity impact described (C:N/I:N); the effect is purely availability-focused (A:H).

No evidence of in-the-wild exploitation, threat actor attribution, or exploit code publication is present in the available data.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), with subscores: AV:N (network-reachable), AC:L (low attack complexity), PR:L (low privileges required), UI:N (no user interaction), S:U (scope unchanged), C:N (no confidentiality impact), I:N (no integrity impact), A:H (high availability impact). The temporal and environmental scores are not published; EPSS is not yet assigned by FIRST.org.

Business impact. For any Grav deployment with delegated content workflows, the practical impact is an availability risk that can be activated by an insider or a compromised low-privileged account and then sustained by anyone — including unauthenticated visitors, scrapers, or competitors. Editorial and marketing sites that depend on Grav for public-facing content can experience persistent page unavailability. Because the trigger is stored in content, simply blocking the original uploader's session does not remove the weapon; the poisoned page must be identified and remediated.

Affected systems. All deployments of Grav before 2.1.7 that run PHP with either the GD or the Imagick extension enabled for media processing, and that permit more than one class of user to upload media. Single-author, fully trusted deployments reduce (but do not eliminate) exposure, since the PR:L requirement is trivial to satisfy for the site owner — though the more realistic threat is a multi-author community or a compromised contributor account.

Blast radius. The description frames the impact as "page unavailability," indicating the affected surface includes the poisoned content page and, under memory contention, neighboring pages sharing the same PHP worker pool. There is no described cross-tenant or data-exfiltration impact; the scope is unchanged (S:U). Sites behind a shared hosting or shared FPM pool face the widest potential blast radius because memory exhaustion in one pool can degrade unrelated applications. The absence of a CISA KEV listing and public exploit code limits near-term opportunistic mass exploitation, but the low technical complexity of the mechanism keeps the residual risk meaningful.

Detection Guidance

Detection should focus on two phases: (a) the upload of abnormally compressed, large-canvas image files by a media author, and (b) repeated rendering requests that drive abnormal memory consumption or worker failures.

Sigma Rule

title: Grav Potential Image Decompression Bomb Upload (CVE-2026-109324)
id: 6f4a1c2e-9b3d-4e77-8a10-2d5c7f9e0b41
status: experimental
description: Detects upload of image media to a Grav site where the decoded dimensions are abnormally large relative to the file size, consistent with a decompression-bomb denial of service attempt against CVE-2026-109324.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109324
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1499
logsource:
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/user/pages/'
      - '/user/images/'
      - '/user/themes/'
      - '/images/'
  selection_ext:
    TargetFilename|endswith:
      - '.png'
      - '.jpg'
      - '.jpeg'
      - '.gif'
      - '.tif'
      - '.tiff'
      - '.webp'
  selection_size:
    # Small on-disk files that expand to very large canvases when decoded
    FileSize|lt: 262144
  condition: selection_path and selection_ext and selection_size
falsepositives:
  - Legitimate highly-compressed but dimensionally modest web images
level: medium

YARA Rule

rule CVE_2026_109324_Grav_Image_Decompression_Bomb
{
    meta:
        description = "Heuristically flags raster files whose declared pixel canvas is disproportionately large relative to their compressed size, consistent with the image decompression-bomb denial of service affecting Grav before 2.1.7 (CVE-2026-109324)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109324"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $png_sig = { 89 50 4E 47 0D 0A 1A 0A }
        $jpg_sig = { FF D8 FF }
        $gif_sig = { 47 49 46 38 }
        $tiff_le = { 49 49 2A 00 }
        $tiff_be = { 4D 4D 00 2A }

    condition:
        filesize < 256KB and
        (
            $png_sig at 0 or
            $jpg_sig at 0 or
            $gif_sig at 0 or
            $tiff_le at 0 or
            $tiff_be at 0
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109324 Grav Image Decompression Bomb Attempt - Oversized Raster Upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/user/pages/"; http.header; content:"Content-Type|3a 20|image/"; classtype:attempted-dos; reference:cve,2026-109324; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109324; sid:1093240; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-109324 Grav Repeated Media Transform Render Requests (Potential Memory Exhaustion Trigger)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/user/pages/"; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; reference:cve,2026-109324; sid:1093241; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.name with maxspan=30s
  [ file where file.extension in ("png", "jpg", "jpeg", "gif", "tif", "tiff", "webp")
      and file.size < 262144
      and file.path : ("*/user/pages/*", "*/user/images/*", "*/user/themes/*", "*/images/*") ]
  [ file where file.extension in ("png", "jpg", "jpeg", "gif", "tif", "tiff", "webp")
      and file.size < 262144
      and file.path : ("*/user/pages/*", "*/user/images/*", "*/user/themes/*", "*/images/*") ]

Alternate process-side variant for PHP worker memory exhaustion:

sequence by host.name with maxspan=2m
  [ process where process.name : ("php", "php-fpm", "php-fpm7*", "php-cgi") and
      process.command_line : "*grav*" ]
  [ process where event.action == "end" and process.name : ("php", "php-fpm", "php-cgi") and
      process.exit_code != 0 ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_grav=if(match(uri, "(?i)/user/(pages|images|themes)/"), 1, 0)
| where is_grav=1
| stats count as req_count, dc(clientip) as unique_clients,
        values(uri) as uris, sum(bytes) as bytes_out
        by clientip, uri, status
| where req_count > 100 OR status >= 500
| sort - req_count
| table clientip, uri, status, req_count, unique_clients, bytes_out

Companion PHP error-log search for worker exhaustion:

index=php sourcetype=php_error
| search "Allowed memory size" OR "Out of memory" OR "exhausted"
| rex field=_raw "(?<php_script>[^\s:]+\.php)"
| where like(php_script, "%/grav/%") OR match(php_script, "(?i)(system|index)\.php")
| stats count as oom_events, values(php_script) as scripts by host
| where oom_events > 5
| sort - oom_events

Wazuh OSSEC Rule

<group name="web,grav,cve-2026-109324,">
  <rule id="1093240" level="10">
    <if_sid>31100</if_sid>
    <id>^200$</id>
    <url>user/pages/|user/images/|user/themes/</url>
    <description>CVE-2026-109324: Grav media upload to content path detected (potential image decompression bomb staging).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="1093241" level="12" frequency="100" timeframe="60">
    <if_matched_sid>1093240</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-109324: High-frequency Grav media/content requests from same source (possible repeated image transform memory exhaustion trigger).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="1093242" level="12">
    <if_sid>31533</if_sid>
    <match>Allowed memory size|Out of memory|Cannot allocate memory</match>
    <description>CVE-2026-109324: PHP memory exhaustion detected, consistent with Grav image decode denial of service.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata is present in the available intelligence, and no patch diff is available to confirm the exact remediation location.

1. Immediate mitigations (until a verified patch is applied):

• Enforce decoded-dimension limits at the PHP layer. Configure memory_limit conservatively so a single image decode cannot exhaust a worker, and keep worker pools sized so one pathological decode does not starve the pool. This is a containment measure, not a fix.
• Restrict media author provisioning. Because the PR:L prerequisite is a media author account, tighten who can be granted upload rights, disable self-registration of contributors, and review existing media-author accounts for legitimacy. Treat the media author role as a privileged trust boundary for this issue.
• Apply reverse-proxy request shaping. Rate-limit requests to Grav content paths and cap concurrent requests per source IP or per session. Since triggering requires no authentication, edge-layer throttling is the most direct control on the amplification step.
• Audit existing media for image bombs. Scan the content and media directories for raster files whose decoded canvas dimensions are disproportionate to their on-disk size. Any such asset referenced by a Twig or Markdown transform should be pulled and the referencing content corrected.
• Ensure decoded-dimension validation is imposed upstream. Until Grav performs its own dimension check, insert a preflight validation layer that inspects image headers for declared width/height and rejects assets whose decoded pixel count exceeds a sane threshold before GD or Imagick is invoked.
• Consider disabling one decoder backend temporarily. If a stable configuration permits, restricting to a single decoder reduces the number of unguarded decode paths exercised, though it does not close the missing-dimension-check flaw.

2. Patch / upgrade steps:

• Target Grav 2.1.7 as the fixed release, since the NVD description states the vulnerability exists "before 2.1.7." No patch confidence evidence is available, so verify the changelog and any vendor advisory before relying on this version as fully remediated.
• Before upgrading, inventory custom Twig templates, Markdown transform usage, and any third-party plugins that invoke GD or Imagick, as those may independently decode media without Grav core's checks even after the core upgrade.
• After upgrade, re-validate the previously identified suspicious assets and confirm that the transform path now rejects or safely degrades on oversized declarations.
• Because patch confidence is 0/4, maintain compensating controls until a confirmed fix is independently verified.

3. Long-term hardening:

• Adopt a media ingestion policy that validates declared image dimensions and total pixel count on upload, independent of Grav's internal handling, and records the result for audit.
• Run PHP-FPM with per-pool memory and process limits, monitoring for out-of-memory events as a security signal rather than only an operational one.
• Segment trust: separate low-trust media contributors from production rendering infrastructure where feasible, and serve user-uploaded media from a distinct origin or subdomain.
• Integrate the detection content above (Sigma, Suricata, EQL, SPL, Wazuh) into existing pipelines and tune thresholds against baseline traffic to reduce false positives from legitimate compressed web imagery.
• Track the Grav release channel and NVD entry for CVE-2026-109324 for a confirmed fix, reassessing patch confidence as vendor evidence becomes available.

References

• NVD — CVE-2026-109324: https://nvd.nist.gov/vuln/detail/CVE-2026-109324
• Grav project (vendor) release and advisory channel: https://github.com/getgrav/grav/releases
• CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification): https://cwe.mitre.org/data/definitions/409.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-109324 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST.org EPSS (no score assigned at time of writing): https://www.first.org/epss/

Exploit-in-the-wild and campaign status: No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-109324. There is no evidence of in-the-wild exploitation, threat actor attribution, or known campaign activity associated with this CVE in the provided intelligence. The CVE is not listed in the CISA KEV catalog.