Grav versions before 2.0.0-beta.2 are affected by an XML External Entity (XXE) injection vulnerability in the SVG file upload functionality. This flaw allows authenticated attackers to read arbitrary files on the server by exploiting improper handling of XML entities in SVG files. The vulnerability arises because the application uses simplexml_load_string without disabling external entity loading. A patch is available to address this issue.