Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-29924
7.6
HIGHCVSS v3
Published
March 30, 2026
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.
getgrav/grav
GitHubModern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
GitHubModern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony< 1.8.0NVD
getgrav/grav
PackagistModern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS
PackagistModern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS< 1.8.0NVD