CVE-2026-56701: Grav - XML External Entity Injection via SVG Upload
Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexmlloadstring without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.0-beta.2 - Configuration
Disable external entity loading when parsing uploaded SVG files (ensure simplexml_load_string is not invoked with external entity loading enabled or use an XML parser/configuration that disables external entity expansion) to prevent XXE.
Grav SVG/XML processing external_entity_loading = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56701?
The severity of CVE-2026-56701 is medium, rated at 6.5 on the CVSS scale.
How do I fix CVE-2026-56701?
To fix CVE-2026-56701, update Grav to version 2.0.0-beta.2 or later.
What type of vulnerability is CVE-2026-56701?
CVE-2026-56701 is an XML External Entity (XXE) injection vulnerability.
What can attackers do with CVE-2026-56701?
Attackers can exploit CVE-2026-56701 to read arbitrary files on the server by uploading SVG files with malicious payloads.
Who is affected by CVE-2026-56701?
Grav users running versions prior to 2.0.0-beta.2 are affected by CVE-2026-56701.