CVE-2026-29924

EUVD-2026-17148 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-03-30 mitre

XXE File Upload

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 18:45 euvd

EUVD-2026-17148

Analysis Generated

Mar 30, 2026 - 18:45 vuln.today

CVE Published

Mar 30, 2026 - 00:00 nvd

HIGH 7.6

DescriptionCVE.org

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

AnalysisAI

Grav CMS versions 1.7.x and earlier allow XML External Entity (XXE) injection through SVG file uploads in the administrative panel and File Manager plugin, potentially enabling remote code execution or information disclosure to authenticated administrators. No CVSS score, CVSS vector, or CWE classification has been assigned; exploitation status and patch availability cannot be confirmed from available data.

Technical ContextAI

XXE vulnerabilities occur when XML parsers process untrusted XML input without disabling external entity resolution. SVG files are XML-based image formats commonly processed during file upload handling. Grav CMS's admin panel and File Manager plugin appear to accept SVG uploads and parse them server-side without proper entity restriction. An attacker can craft a malicious SVG containing DOCTYPE declarations that reference external resources (files, URLs, or entity expansion attacks), leading to information disclosure (local file read), denial of service (billion laughs attack), or in some contexts, remote code execution depending on the underlying XML parser library and system configuration.

RemediationAI

No vendor-released patch has been identified in the provided data. Users should immediately review the official Grav GitHub repository (https://github.com/getgrav/grav) and check for security advisories or patches. In the interim, disable SVG file uploads in the admin panel and File Manager plugin if possible, restrict file upload permissions to trusted administrators only, and implement input validation to reject SVG files or sanitize XML parsing by disabling external entity resolution in the web server or application configuration. Contact Grav project maintainers directly for patch availability and timeline.