Grav · Grav · CVE-2026-56701
**Name of the Vulnerable Software and Affected Versions**
Grav versions prior to 2.0.0-beta.2
**Description**
An XML external entity (XXE) injection exists in the processing of SVG file uploads. Authenticated attackers can read arbitrary files by injecting XXE payloads via malicious SVG files. This occurs because the application utilizes the `simplexml load string()` function without disabling the loading of external entities, which allows for the exfiltration of sensitive data.
**Recommendations**
Update to version 2.0.0-beta.2 or later.