{"id":"CVE-2026-56701","title":"Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files","summary":"Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling exte…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-611"],"vendor":"Grav","product":"Grav","affected":["Grav < 2.0.0-beta.2"],"patched":["getgrav/grav 2.0.0-beta.2"],"published":"2026-06-23","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:17:22.543","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56701","references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-3446-6mgw-f79p","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-xml-external-entity-injection-via-svg-upload","label":"disclosure@vulncheck.com"},{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-3446-6mgw-f79p","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56701"},{"url":"https://github.com/advisories/GHSA-3446-6mgw-f79p"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-23T14:35:03.732699Z"},"epss":0.00305,"epssPercentile":0.23155,"aliases":["GHSA-3446-6mgw-f79p"],"ecosystem":"composer","ingestedAt":"2026-09-23T21:33:13.539Z","slug":"CVE-2026-56701","body":"## Overview\n\nGrav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files to exfiltrate sensitive data.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-56701)\n\nAffected packages:\n\n- `getgrav/grav < 2.0.0-beta.2`\n\nPatched in:\n\n- `getgrav/grav 2.0.0-beta.2`\n\nSource: https://github.com/advisories/GHSA-3446-6mgw-f79p","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":218124,"id":"CVE-2026-56701","ts":1791478409874,"field":"exploit_available","old":"false","new":"true"}]}