Executive brief
Grav is a flat-file content management system used to build and manage websites. This vulnerability allows authenticated users with admin panel access to read arbitrary files from the server by uploading specially crafted SVG files that exploit XML parsing. An attacker could access sensitive configuration files, API keys, admin credentials, and system information, compromising the confidentiality of data stored on the server.
Technical details
This is an XML External Entity (XXE) injection vulnerability in Grav's SVG file upload handler. The root cause is the unsafe use of simplexml_load_string() to parse SVG files without disabling external entity loading (missing LIBXML_NOENT flag or entity protection mechanisms). The attack requires authentication to the Grav admin panel; an attacker uploads a malicious SVG file containing XXE payloads that are processed during parsing, allowing file exfiltration via entity injection. An authenticated attacker can read sensitive server files including /etc/passwd, admin credentials (user/accounts/*.yaml), system configuration, and environment variables. The vulnerability was patched in Grav 2.0.0-beta.2; the fix involves either adding XXE protection flags or using a dedicated SVG sanitizer library.
Affected products
- Grav Grav CMS < 2.0.0-beta.2
Timeline
- 2026-04-27: disclosed
- 2026-06-23: advisory
- 2026-06-23: patched: 2.0.0-beta.2 released