Grav CMS XML External Entity Vulnerability in SVG File Upload

A vulnerability allowing XML External Entity (XXE) attacks has been identified in Grav CMS versions through 1.7.x. This issue arises from the SVG file upload feature in the admin panel, specifically within the File Manager plugin.

Impact

Exploitation of this vulnerability could lead to XML External Entity attacks, allowing an attacker to interfere with the application's processing of XML data. This could potentially be used to read local files or conduct a denial-of-service attack by causing the application to process an excessive amount of data.