CVE-2026-29924: XEE
Published Mar 30, 2026
·Updated
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
Affected Software
2 affected components
Grav Grav CMS<=1.7.x
getgrav grav<1.8.0
Event History
Mar 30, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-29924?
CVE-2026-29924 is considered a high-severity vulnerability due to the potential for XML External Entity (XXE) attacks.
2
How do I fix CVE-2026-29924?
To fix CVE-2026-29924, upgrade Grav CMS to version 1.8.0 or later, as it mitigates the XML External Entity vulnerability.
3
What is the impact of CVE-2026-29924?
The impact of CVE-2026-29924 includes the possibility of data leakage and server-side request forgery through the exploitation of XXE in SVG file uploads.
4
Which versions of Grav CMS are affected by CVE-2026-29924?
Grav CMS version 1.7.x and earlier are affected by CVE-2026-29924.
5
Can I mitigate CVE-2026-29924 without upgrading?
While the best way to address CVE-2026-29924 is to upgrade, you can implement strict input validation on file uploads to reduce risk.