Grav CMS v1.7.x and earlier contains an XML External Entity vulnerability in its file upload components that could allow an authenticated attacker to disclose sensitive local files.

The application fails to properly sanitize XML input processed during SVG file uploads. This vulnerability requires the attacker to have low-level access to the admin panel or File Manager plugin to trigger the malicious payload.

The exploitation of this XXE vulnerability could lead to the unauthorized disclosure of sensitive server-side files, potentially exposing configuration data or credentials. With a CVSS score of 7.6, this flaw is categorized as High severity, presenting a significant risk to the confidentiality of the underlying infrastructure and the integrity of the hosted content.

Immediate Action: Administrators should audit the Grav CMS installation and restrict access to the administrative panel and File Manager plugin to trusted users only until a vendor patch is released.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious POST requests directed at file upload endpoints that contain XML-formatted data.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block XML-based file uploads or block SVG files entirely from the upload interface to mitigate potential exploitation attempts.

Public Exploit Available: No (exploit_available: false)

Given the High severity of this flaw, administrators must prioritize restricting access to the administrative interface. While no specific patch version is currently identified, monitoring for updates from the Grav project is essential, and the application of security updates should be performed immediately upon availability to remediate the underlying XXE risk.