swornim619/cve-2026-65650PoC for CVE-2026-65650 - Elgg avatar upload DoS
Authenticated denial of service in Elgg's avatar upload feature via unbounded image dimensions, causing GD memory exhaustion.
< 6.3.5 (6.x line), and 7.0.0-rc.1 – < 7.0.0 (7.0 release candidates)6.3.5, 7.0.0actions/avatar/upload.php passes uploaded images straight into saveIconFromUploadedFile() with no dimension, size, or memory guard:
$avatar = elgg_get_uploaded_file('avatar', false);
// No dimension check.
// No size check.
// No ratio check.
if (!$owner->saveIconFromUploadedFile('avatar')) {
return elgg_error_response(elgg_echo('avatar:resize:fail'));
}
PHP's GD library allocates memory based on an image's decoded pixel dimensions, not its on-disk file size. A small file with extreme dimensions therefore forces a huge allocation the moment GD touches it.
Step 1 — python3 CVE-2026-65650.py
Step 2 — Log in as any registered user.
Step 3 — Navigate to Profile > Edit Avatar and upload CVE-2026-65650.png.
Running the PoC forces GD to allocate ~286 MB to decode the image and ~572 MB more to resize it, despite the file itself being ~308 KB on disk. On a 14 GB / no-swap test box, a single upload dropped available memory to ~1.3 GB. On memory-constrained deployments this is enough to trigger a kernel OOM kill of PHP-FPM workers, taking the site down with no self-recovery.
A single request from a single low-privileged account is enough to drive this consumption. Repeated or concurrent requests from multiple accounts compound the effect and increase the likelihood of hitting OOM.
Fixed in Elgg 7.0.0 and backported to 6.3.5.