XML External Entity injection in Grav CMS - #VU130087
Published: May 5, 2026
Vulnerability identifier: #VU130087
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper restriction of xml external entity reference in SVG file upload and processing when parsing uploaded SVG files. A remote user can upload a specially crafted SVG file to disclose sensitive information.
The issue can be reached through the admin panel, including the Pages media workflow or the File Manager plugin.
Affected software
Grav CMS
Remediation
Install security update from vendor's website.
Grav CMS - update to 2.0.0 beta.2