CVE-2026-29924: Grav CMS XXE Vulnerability via SVG Upload

CVE-2026-29924 Overview

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin. This vulnerability allows authenticated attackers to exploit improper XML parsing when processing SVG files, potentially leading to sensitive data exposure, server-side request forgery, and denial of service conditions.

Critical Impact

Authenticated attackers can exploit SVG file uploads to read sensitive server files, perform SSRF attacks, and potentially compromise the underlying system through XML External Entity injection.

Affected Products

• Grav CMS v1.7.x and earlier versions
• Grav Admin Panel with SVG upload capability
• Grav File Manager Plugin

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-29924 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-29924

Vulnerability Analysis

This vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The flaw exists in how Grav CMS processes SVG file uploads within the admin panel and File Manager plugin. SVG files are XML-based vector graphics that can contain Document Type Definitions (DTDs) with external entity declarations. When the application parses these SVG files without properly disabling external entity processing, an attacker can inject malicious XML entities that reference local files or external resources.

The vulnerability requires authenticated access to the admin panel or File Manager plugin, meaning an attacker would need valid credentials before exploiting this issue. However, once authenticated, the attacker can craft malicious SVG files containing XXE payloads to exfiltrate sensitive data from the server filesystem, probe internal network resources, or cause denial of service through entity expansion attacks.

Root Cause

The root cause of this vulnerability is the improper configuration of the XML parser used to process SVG file uploads in Grav CMS. When SVG files are uploaded through the admin panel or File Manager plugin, the XML parser does not disable external entity resolution. This allows the parser to fetch and include content from external URIs or local file paths specified within DTD declarations embedded in the SVG file. Proper secure XML parsing should disable libxml_disable_entity_loader() and configure the parser to prevent external entity processing.

Attack Vector

The attack vector is network-based and requires low-privilege authenticated access. An attacker with access to the Grav CMS admin panel can upload a specially crafted SVG file containing XXE payloads. The malicious SVG would include a DTD declaration with external entity references pointing to sensitive files such as /etc/passwd, configuration files, or internal network endpoints.

When the server processes the uploaded SVG (during preview generation, rendering, or validation), the XML parser resolves the external entities, causing the contents of referenced files or resources to be included in the response or error messages. This can lead to disclosure of sensitive configuration data, database credentials, or other confidential information stored on the server.

The vulnerability mechanism exploits the SVG file upload feature. When a malicious SVG containing DTD declarations with external entity references is uploaded, the XML parser processes these entities, resolving them to local file paths or external URLs. See the Grav GitHub repository for technical details and updates.

Detection Methods for CVE-2026-29924

Indicators of Compromise

• SVG file uploads containing suspicious DTD declarations or ENTITY keywords in the admin panel upload logs
• Unusual file access patterns on sensitive system files such as /etc/passwd, /etc/shadow, or application configuration files
• Error logs showing XML parsing errors referencing external URIs or local file paths
• Outbound network connections from the web server to unexpected internal or external destinations

Detection Strategies

• Monitor and log all SVG file uploads to the Grav CMS admin panel and File Manager plugin
• Implement content inspection rules to detect XXE payloads in uploaded XML-based files (SVG, XML, XHTML)
• Configure web application firewall (WAF) rules to block requests containing DTD declarations or ENTITY references
• Enable verbose logging for XML parsing operations to capture potential exploitation attempts

Monitoring Recommendations

• Implement file integrity monitoring on sensitive configuration files and system files
• Configure SIEM alerts for unusual file read operations initiated by the web server process
• Monitor for outbound connections from the web application server to internal network segments or external resources
• Review admin panel authentication logs for unauthorized access attempts preceding file upload activity

How to Mitigate CVE-2026-29924

Immediate Actions Required

• Restrict SVG file uploads in the Grav CMS admin panel until a patch is applied
• Implement input validation to strip or reject SVG files containing DTD declarations
• Review and audit existing uploaded SVG files for potential malicious content
• Limit admin panel access to trusted users and network segments

Patch Information

Organizations should monitor the Grav CMS GitHub repository for official security patches addressing this XXE vulnerability. Until a patch is released, implement the workarounds described below to reduce exposure. Ensure you are subscribed to Grav CMS security announcements to receive timely updates when fixes become available.

Workarounds

• Disable SVG file uploads entirely in the Grav CMS configuration until a patch is available
• Configure the PHP XML parser to disable external entity loading using libxml_disable_entity_loader(true) at the application level
• Implement server-side SVG sanitization to strip DOCTYPE declarations and ENTITY references before processing
• Use a web application firewall to filter and block SVG uploads containing XXE payloads

Disable external entity loading in PHP to mitigate XXE attacks:

# Add to php.ini or application configuration
# Disable external entity loading for PHP's libxml
libxml_disable_entity_loader(true);

# For Grav CMS, consider adding to user/config/system.yaml:
# security:
#   svg_uploads: false