CVE-2026-56701

Summary

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.

Affected Software

Weaknesses

• CWE-611: Improper Restriction of XML External Entity Reference

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/getgrav/grav/security/advisories/GHSA-3446-6mgw-f79p

References

• https://github.com/getgrav/grav/security/advisories/GHSA-3446-6mgw-f79p
• https://www.vulncheck.com/advisories/grav-xml-external-entity-injection-via-svg-upload

• ←Previous
• Next→