Which versions of Grav CMS are affected by CVE-2026-56701?

Grav CMS versions prior to 2.0.0-beta.2 contain a file disclosure flaw in SVG upload handling that allows authenticated administrators to exfiltrate credentials, configuration, and environment…. A patch is available.

How to fix or mitigate CVE-2026-56701?

Within 24 hours: disable SVG upload functionality or restrict uploads to authenticated users only; audit admin account access logs for suspicious activity. Within 7 days: isolate Grav CMS admin panels behind additional network controls (VPN, IP allowlisting); review and rotate any credentials or secrets accessible from the server filesystem. Within 30 days: evaluate migration to Grav CMS 2.0.0-beta.2 or later once stability is confirmed, or implement application-level XML entity protections as an interim control.

Grav CMS CVE-2026-56701

Q: What is the CVSS score of CVE-2026-56701?

CVE-2026-56701 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38442 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-06-23 VulnCheck

GHSA-32fw-h446-j4hh

XXE File Upload Information Disclosure Grav

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable admin upload (AV:N/AC:L), requires authenticated admin (PR:L), no UI; reads arbitrary files so C:H, but no write or DoS at base, so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 14:17 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 13:06 vuln.today

Analysis Generated

Jun 23, 2026 - 13:06 vuln.today

DescriptionCVE.org

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.

AnalysisAI

Arbitrary file disclosure in Grav CMS versions prior to 2.0.0-beta.2 allows authenticated admin-panel users to read sensitive server files via XML External Entity (XXE) injection in SVG upload processing. The flaw stems from simplexml_load_string() being called without entity-loader protections, enabling exfiltration of credentials, configuration, and environment secrets. No public exploit identified at time of analysis, though the GHSA advisory includes a working proof-of-concept payload.

Technical ContextAI

Grav is a flat-file PHP CMS by Trilby Media that stores content as Markdown/YAML rather than in a database. The vulnerable code path uses PHP's libxml-backed simplexml_load_string() to parse uploaded SVG files (which are XML documents) in the Pages → Media and File Manager upload handlers, without passing LIBXML_NONET or otherwise disabling external entity resolution. CWE-611 (Improper Restriction of XML External Entity Reference) covers this class: when an XML parser resolves a DOCTYPE-declared SYSTEM entity such as file:///etc/passwd, the file contents are inlined into the parsed document and returned to the attacker, also enabling SSRF via http(s) URIs and billion-laughs DoS via recursive entity expansion. The single affected CPE is cpe:2.3:a:grav:grav.

RemediationAI

Vendor-released patch: upgrade Grav to 2.0.0-beta.2 or later, which corresponds to upstream commit 5a12f9be8314682c8713e569e330f11805d0a663 (https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663); see the GHSA advisory at https://github.com/getgrav/grav/security/advisories/GHSA-3446-6mgw-f79p for full details. Operators unable to immediately upgrade should restrict admin-panel access by IP allowlist and enforce strong/MFA-protected admin credentials to shrink the authenticated attack surface, and can disable or block SVG uploads in the Media and File Manager workflows (trade-off: legitimate users lose SVG asset support) until patched. As a deeper defense-in-depth measure, harden the PHP runtime by ensuring libxml_disable_entity_loader(true) or equivalent LIBXML_NONET handling is in effect for any custom SVG processing, with the side effect that legitimately referenced external resources in XML will no longer resolve.