EUVD-2026-17148Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
AnalysisAI
Grav CMS versions 1.7.x and earlier allow XML External Entity (XXE) injection through SVG file uploads in the administrative panel and File Manager plugin, potentially enabling remote code execution or information disclosure to authenticated administrators. No CVSS score, CVSS vector, or CWE classification has been assigned; exploitation status and patch availability cannot be confirmed from available data.
Technical ContextAI
XXE vulnerabilities occur when XML parsers process untrusted XML input without disabling external entity resolution. SVG files are XML-based image formats commonly processed during file upload handling. Grav CMS's admin panel and File Manager plugin appear to accept SVG uploads and parse them server-side without proper entity restriction. An attacker can craft a malicious SVG containing DOCTYPE declarations that reference external resources (files, URLs, or entity expansion attacks), leading to information disclosure (local file read), denial of service (billion laughs attack), or in some contexts, remote code execution depending on the underlying XML parser library and system configuration.
RemediationAI
No vendor-released patch has been identified in the provided data. Users should immediately review the official Grav GitHub repository (https://github.com/getgrav/grav) and check for security advisories or patches. In the interim, disable SVG file uploads in the admin panel and File Manager plugin if possible, restrict file upload permissions to trusted administrators only, and implement input validation to reject SVG files or sanitize XML parsing by disabling external entity resolution in the web server or application configuration. Contact Grav project maintainers directly for patch availability and timeline.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Share
External POC / Exploit Code
Leaving vuln.today