AIKIDO-2026-52430

TL;DR

The curation editor's save action takes the crop box's width and height directly from the client and only validates a minimum value, so the crop is never clamped to the source image and is padded instead before any preset resize. An account that can edit media and open the curation editor can request an arbitrarily large crop, exhausting the PHP worker's memory and writing large padded files to disk, and the save action performs no authorization check of its own. The fix requires the update ability on the media before saving, locks the media being curated from browser changes, keeps the crop box within the image, and caps output dimensions with a new curator.curation_max_dimension setting.