Grav versions prior to 2.0.0‑beta.2 process user uploaded SVG files using simplexml_load_string without disabling external entity loading. This flaw permits XML external entity (XXE) injection, allowing an attacker who has authenticated access to supply a crafted SVG file that references external entities. The attacker can cause the server to read arbitrary local files, exfiltrating sensitive content such as configuration data or credentials. The vulnerability is a classic XXE flaw, classified under CWE‑611 and poses a high confidentiality risk.

The affected product is Grav, the popular flat‑file CMS. Vulnerable releases are all builds before 2.0.0‑beta.2. No specific patch rollout dates are listed, but any deployment of these pre‑beta versions is susceptible.

The CVSS base score of 7.1 indicates a high severity. The EPSS score is not available, but because the flaw requires authenticated access, only users who can log into the Grav back‑office can exploit it. The vulnerability is not listed in the CISA KEV catalog, suggesting no public exploit yet, yet the combination of a high CVSS and the formulaic exploitation path indicates a non‑negligible risk. Authentication is a prerequisite, so unauthenticated users cannot trigger the vulnerability, but once inside the admin zone the attacker can read any file available to the server process.