CVE-2026-29924

HIGH CVSS 7.6 View on NVD ↗

Description

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/getgrav/grav

Published: Mar 30, 2026 19:16 UTC Modified: Mar 30, 2026 20:16 UTC