[security] Bound URL-based image transforms to prevent memory-exhaustion DoS

URL query image actions (e.g. `?resize=`) are now disabled by default via
`system.images.url_actions`, and when enabled are rejected above a configurable
total-pixel ceiling (`system.images.max_pixels`, default 25M). This closes the
unauthenticated DoS where oversized resize dimensions drove unbounded GD/Imagick
memory allocation outside PHP's memory_limit (CWE-400, GHSA-4x9g-vw65-vvf9).

Backport of the 2.0 fix to the 1.7 line. Reported by @iliaal.

Author: rhukster

CHANGELOG.md

@@ -1,10 +1,11 @@
 # v1.7.53
-## 06/09/2026
+## 06/10/2026
 
 1. [](#bugfix)
     * [security] Direct web access to the `user/accounts`, `user/config`, `user/data` and `user/env` folders is now blocked outright in every bundled webserver config, closing a hole where files such as certificates, tokens and databases stored under `user/data` with an unlisted extension could be downloaded directly.
     * [security] A backup deny-all `.htaccess` now ships inside `user/accounts`, `user/config` and `user/data` so Apache installs stay protected even when the site root `.htaccess` has been customised or is out of date.
     * [security] The upgrade postflight now patches an existing stock root `.htaccess` to add the folder block automatically, so installs that updated from an earlier version are protected without editing the file by hand.
+    * [security] URL query image transforms (such as `image.jpg?resize=`) are now turned off by default and, when enabled, refuse oversized dimensions above a configurable pixel limit, closing an unauthenticated denial of service where huge resize values could exhaust server memory.
 
 # v1.7.52
 ## 04/29/2026

system/blueprints/config/system.yaml

@@ -1357,6 +1357,26 @@ form:
               validate:
                 type: bool
 
+            images.url_actions:
+              type: toggle
+              label: PLUGIN_ADMIN.IMAGES_URL_ACTIONS
+              help: PLUGIN_ADMIN.IMAGES_URL_ACTIONS_HELP
+              highlight: 0
+              options:
+                1: PLUGIN_ADMIN.YES
+                0: PLUGIN_ADMIN.NO
+              validate:
+                type: bool
+
+            images.max_pixels:
+              type: text
+              size: small
+              label: PLUGIN_ADMIN.IMAGES_MAX_PIXELS
+              help: PLUGIN_ADMIN.IMAGES_MAX_PIXELS_HELP
+              validate:
+                type: int
+                min: 0
+
             media.enable_media_timestamp:
               type: toggle
               label: PLUGIN_ADMIN.ENABLE_MEDIA_TIMESTAMP

system/config/system.yaml

@@ -164,6 +164,8 @@ images:
   debug: false                                   # Show an overlay over images indicating the pixel depth of the image when working with retina for example
   auto_fix_orientation: true                     # Automatically fix the image orientation based on the Exif data
   seofriendly: false                             # SEO-friendly processed image names
+  url_actions: false                             # Allow URL query-based image transforms (e.g. `image.jpg?resize=600,400`). Off by default; normal Twig/Markdown resizing is unaffected
+  max_pixels: 25000000                           # Total-pixel ceiling (width*height) for URL-based resize actions. Requests above this are refused. 0 disables the check
   cls:                                           # Cumulative Layout Shift: See https://web.dev/optimize-cls/
     auto_sizes: false                            # Automatically add height/width to image
     aspect_ratio: false                          # Reserve space with aspect ratio style

system/src/Grav/Common/Grav.php

@@ -797,11 +797,38 @@ public function fallbackUrl($path)
             if (isset($media[$media_file])) {
                 /** @var Medium $medium */
                 $medium = $media[$media_file];
-                foreach ($uri->query(null, true) as $action => $params) {
-                    if (in_array($action, ImageMedium::$magic_actions, true)) {
-                        call_user_func_array([&$medium, $action], explode(',', $params));
+
+                // URL-based media actions (e.g. `image.jpg?resize=600,400`) let an
+                // unauthenticated visitor drive image transforms straight from the
+                // query string. They are opt-in and disabled by default: the normal
+                // resize path is Twig/Markdown media methods, which run with
+                // developer-controlled arguments and are unaffected by this toggle.
+                if ($config->get('system.images.url_actions', false)) {
+                    $max_pixels = (int) $config->get('system.images.max_pixels', 25000000);
+                    foreach ($uri->query(null, true) as $action => $params) {
+                        if (in_array($action, ImageMedium::$magic_actions, true)) {
+                            $args = explode(',', (string) $params);
+                            // Reject request-derived resize dimensions above the
+                            // total-pixel ceiling. The GD/Imagick output buffer is
+                            // allocated as width*height*4 bytes outside PHP's
+                            // memory_limit, so an unbounded request exhausts RAM.
+                            // The output width/height are the last two positions in
+                            // each $magic_resize_actions entry (crop is x,y,w,h).
+                            if ($max_pixels > 0 && isset(ImageMedium::$magic_resize_actions[$action])) {
+                                $positions = ImageMedium::$magic_resize_actions[$action];
+                                $w_pos = $positions[count($positions) - 2] ?? null;
+                                $h_pos = $positions[count($positions) - 1] ?? null;
+                                $width = ($w_pos !== null && isset($args[$w_pos]) && is_numeric($args[$w_pos])) ? (int) $args[$w_pos] : 0;
+                                $height = ($h_pos !== null && isset($args[$h_pos]) && is_numeric($args[$h_pos])) ? (int) $args[$h_pos] : 0;
+                                if ($width > 0 && $height > 0 && ($width * $height) > $max_pixels) {
+                                    return false;
+                                }
+                            }
+                            call_user_func_array([&$medium, $action], $args);
+                        }
                     }
                 }
+
                 Utils::download($medium->path(), false);
             }