The vulnerability is an XML External Entity (XXE) flaw that is triggered when an SVG file is uploaded through the Grav CMS admin panel or its File Manager plugin. XXE flaws permit an attacker to instruct the server to read arbitrary files from the filesystem or to send requests to internal or external hosts. The description does not confirm that code execution is possible, but the flaw can expose sensitive data on the server. This vulnerability is categorized as CWE-611, indicating that attacker-provided external entities are processed by the XML parser.

Grav CMS versions 1.7.x and earlier are affected. The flaw is present in the default SVG upload handling in the admin interface and the File Manager plugin of these releases.

The CVSS base score of 7.6 indicates a high severity, and the EPSS score of less than 1% suggests that exploitation attempts are currently rare. Because the flaw is accessed through the web‑based admin interface, an attacker would need authenticated or privileged access to upload a crafted SVG file. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web interface, requiring that the attacker has permissions to use the admin panel or the File Manager plugin.