GHSA-3446-6mgw-f79p Grav is Vulnerable to XXE via SVG Upload

• Packagist getgrav/grav: < 2.0.0-beta.2 → fixed in 2.0.0-beta.2

Dear Grav Security Team, A security vulnerability was discovered in Grav CMS that allows authenticated attackers to read arbitrary files from the server through XML External Entity (XXE) injection. Vulnerability Summary | Field | Details | |-------|---------| | Vulnerability Type | XML External Entity (XXE) Injection | | Severity | High (CVSS 7.5) | | Affected Versions | Grav CMS ]> &xxe; ``` Steps to Reproduce 1. Login to Grav CMS admin panel 2. Navigate to Pages → select any page → Media tab 3. Upload the malicious SVG file 4. Observe file contents in response/error or stored output Recommended Fix Option 1: Add XXE Protection Flags ```php libxml_use_internal_errors(true); $svg = simplexml_load_string($content, 'SimpleXMLElement', LIBXML_NOENT | LIBXML_DTDLOAD); ``` Option 2: Use SVG Sanitizer Library (Recommended) ```php use enshrined\svgSanitize\Sanitizer; $sanitizer = new Sanitizer(); $sanitizer->removeRemoteReferences(true); $cleanSVG = $sanitizer->sanitize($content); ``` The `enshrined/svg-sanitize` library properly strips XXE payloads and other malicious SVG content. Request 1. Please acknowledge receipt of this report within 5 business days 2. Please provide an estimated timeline for a security patch 3. I am happy to assist with testing the fix 4. I request a CVE be assigned for this vulnerability 5. If you have a security advisory process, please include me in the credits Turki Almatrafi. --- Maintainer note — fix applied (2026-04-24) Fixed across two repos: 1. Grav core on the `2.0` branch (commit `5a12f9be8`, ships in 2.0.0-beta.2) — `VectorImageMedium::__construct` (the code path that reads width/height from an uploaded SVG) now strips `` and `` declarations before parsing, and calls `simplexml_load_string` with `LIBXML_NONET | LIBXML_NOERROR | LIBXML_NOWARNING`. On PHP ]> &xxe; ``` no longer expands `&xxe;`, and the parser cannot make outbound filesystem or network requests for external entities/DTDs. Billion-laughs-style entity expansion is also neutralized because the declarations are stripped before libxml ever sees them. Files: • `system/src/Grav/Common/Page/Medium/VectorImageMedium.php`. • `tests/unit/Grav/Common/Security/SvgXxeSecurityTest.php` — XXE neutralization + billion-laughs + plain-SVG regression. • dom-sanitizer: `src/DOMSanitizer.php` + two new XXE tests in its own suite.