Skip to content
Heist/ feed
Back to feed
High

Grav - XML External Entity Injection via SVG Upload

Type: advisorySources: OSV

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-56701
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:48 UTC · Revision 1

Source evidence

Grav - XML External Entity Injection via SVG Upload

core-osv · Original source

Published 23 Jun 2026, 12:13 UTC

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.

osv:CVE-2026-56701
Complete source record
{
  "id": "a4b992d53bfe44532bbe57d97fac6af4ab1b40d3dc6f0ce9df04a7d2714620d2",
  "url": "https://osv.dev/vulnerability/CVE-2026-56701",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Grav - XML External Entity Injection via SVG Upload",
    "summary": "Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.",
    "evidence": "osv:CVE-2026-56701",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-56701",
      "aliases": [
        "CVE-2026-56701",
        "GHSA-3446-6mgw-f79p"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/getgrav/grav",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3077b04b220318883ed34b6ae2a6cd0f25dba92e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.0.0-beta.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.0.0-beta.2"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "2.0.0-beta.1",
            "1.8.0-beta.29",
            "1.8.0-beta.28",
            "1.8.0-beta.27",
            "1.8.0-beta.26",
            "1.8.0-beta.25",
            "1.8.0-beta.24",
            "1.8.0-beta.23",
            "1.8.0-beta.22",
            "1.8.0-beta.21",
            "1.8.0-beta.20",
            "1.8.0-beta.19",
            "1.8.0-beta.18",
            "1.8.0-beta.17",
            "1.8.0-beta.16",
            "1.8.0-beta.15",
            "1.8.0-beta.14",
            "1.8.0-beta.13",
            "1.8.0-beta.12",
            "1.8.0-beta.11",
            "1.8.0-beta.10",
            "1.8.0-beta.9",
            "1.8.0-beta.8",
            "1.8.0-beta.7",
            "1.8.0-beta.6",
            "1.8.0-beta.5",
            "1.8.0-beta.4",
            "1.8.0-beta.3",
            "1.8.0-beta.2",
            "1.8.0-beta.1",
            "1.7.0-rc.20",
            "1.7.0-rc.19",
            "1.7.0-rc.18",
            "1.7.0-rc.17",
            "1.7.0-rc.15",
            "1.7.0-rc.14",
            "1.7.0-rc.13",
            "1.7.0-rc.12",
            "1.7.0-rc.10",
            "1.7.0-rc.9",
            "1.7.0-rc.8",
            "1.7.0-rc.7",
            "1.7.0-rc.6",
            "1.7.0-rc.5",
            "1.7.0-rc.4",
            "1.7.0-rc.3",
            "1.7.0-rc.2",
            "1.7.0-rc.1",
            "1.7.0-beta.10",
            "1.7.0-beta.9",
            "1.7.0-beta.8",
            "1.7.0-beta.7",
            "1.7.0-beta.6",
            "1.7.0-beta.5",
            "1.7.0-beta.4",
            "1.7.0-beta.3",
            "1.7.0-beta.2",
            "1.7.0-beta.1",
            "1.6.0-rc.4",
            "1.6.0-rc.3",
            "1.6.0-rc.2",
            "1.6.0-rc.1",
            "1.6.0-beta.8",
            "1.6.0-beta.7",
            "1.6.0-beta.6",
            "1.6.0-beta.5",
            "1.6.0-beta.2",
            "1.6.0-beta.1",
            "1.5.0-rc.1",
            "1.5.0-beta.2",
            "1.5.0-beta.1",
            "1.3.0-rc.5",
            "1.3.0-rc.4",
            "1.3.0-rc.3",
            "1.3.0-rc.1",
            "1.2.0-rc.3",
            "1.2.0-rc.2",
            "1.2.0-rc.1",
            "1.1.9-rc.3",
            "1.1.9-rc.2",
            "1.1.9-rc.1",
            "1.1.0-rc.3",
            "1.1.0-rc.2",
            "1.1.0-rc.1",
            "1.1.0-beta.5",
            "1.1.0-beta.4",
            "1.1.0-beta.3",
            "1.1.0-beta.2",
            "1.1.0-beta.1",
            "0.9.19",
            "0.9.18",
            "0.9.17",
            "0.9.16",
            "0.9.15",
            "0.9.14",
            "0.9.13",
            "0.9.12",
            "0.9.11",
            "0.9.10",
            "0.9.9",
            "0.9.8",
            "0.9.7",
            "0.9.6",
            "0.9.5",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.0",
            "0.8.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56701.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.343391162Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56701.json",
        "https://github.com/getgrav/grav/security/advisories/GHSA-3446-6mgw-f79p",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-56701",
        "https://www.vulncheck.com/advisories/grav-xml-external-entity-injection-via-svg-upload"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-611"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56701.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-56701",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522337,
  "published_at": "2026-06-23T12:13:06.215+00:00"
}