Back to CVE List

CVE-2026-56701

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score
6.5 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vulnerability Description

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.

Vulnerability Details

Published Date
Last Modified
CWE ID
CWE-611
Source
NVD
Vendor
Grav
Product
Grav

External References

Discussion (0)

Add Comment

No comments yet. Be the first!