Grav CMS versions before 2.0.0-beta.2 improperly process uploaded SVG files using simplexml_load_string without disabling external entity loading, allowing authenticated attackers to perform XXE attacks. This enables reading sensitive files such as /etc/passwd, user account YAML files, system configuration, and environment secrets. The vulnerability also allows SSRF and potential denial of service via billion laughs attacks. The issue is fixed by stripping DOCTYPE and ENTITY declarations before parsing and using libxml flags (LIBXML_NONET, LIBXML_NOERROR, LIBXML_NOWARNING) and disabling entity loaders on PHP < 8. The fix is implemented in Grav core 2.0.0-beta.2 and the dom-sanitizer library.

An authenticated attacker with admin panel access can exploit this vulnerability to read arbitrary files on the server, including sensitive configuration and credential files, potentially leading to credential disclosure and system information leakage. The attacker can also perform server-side request forgery (SSRF) to access internal services and cause denial of service through recursive entity expansion attacks.

A security fix is available and has been applied in Grav CMS version 2.0.0-beta.2 and the updated dom-sanitizer library. The fix strips DOCTYPE and ENTITY declarations from SVG files before XML parsing and disables external entity loading, preventing XXE exploitation. Users should upgrade to Grav 2.0.0-beta.2 or later and ensure the updated dom-sanitizer library is in use. No additional mitigation actions are required once patched.