CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin

High · published March 30, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.0th percentile
Published
2026-03-30T00:00Z
EPSS history
Timeline
  • 30 MAR 00:00Z
    Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin
    cvelistv5