PT-2026-51515 · Grav · Grav

Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-56701

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml load string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2026-56701

Produtos afetados

Grav

Referências · 3

• https://github.com/getgrav/grav/security/advisories/GHSA-3446-6mgw-f79p · Aviso do Fabricante
• https://vulncheck.com/advisories/grav-xml-external-entity-injection-via-svg-upload · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56701 · Nota de Segurança