Executive brief
Grav CMS, a popular content management system, contains a security flaw in how it handles uploaded image files. An attacker with basic login access can upload a specially crafted SVG image to view sensitive files on the server, such as system passwords or configuration secrets. This could lead to a full compromise of the website's data and underlying server infrastructure.
Technical details
An XML External Entity (XXE) injection vulnerability exists in Grav CMS's SVG processing logic, specifically within the VectorImageMedium component and the dom-sanitizer library. The application uses the PHP function simplexml_load_string() to extract metadata (like width and height) from uploaded SVG files without disabling external entity loading or DTD processing. An authenticated attacker with permissions to upload media can provide a malicious SVG containing a DOCTYPE declaration with a SYSTEM entity. When parsed, this allows the attacker to exfiltrate local files (e.g., /etc/passwd, configuration YAML files) or perform Server-Side Request Forgery (SSRF). The issue is fixed in version 2.0.0-beta.2 by stripping DOCTYPE/ENTITY tags and using LIBXML_NONET flags.
Affected products
- Grav Grav CMS < 2.0.0-beta.2
Timeline
- 2026-04-24: patched: Fix applied to Grav core and dom-sanitizer library
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication and CVE assignment