CVE-2026-29924
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
Published Mar 30, 2026 · updated Jun 17, 2026 · getgrav grav
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 30, 2026 · NIST NVD
Detected
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
Jun 17, 2026 · NIST NVD
Updated
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
Affected
- cpe getgrav/gravversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-29924
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-29924
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
nvd.nist.gov