Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

Grav CMS version 1.7.x and earlier versions are vulnerable to XML External Entity (XXE) attacks through the SVG file upload functionality. The vulnerability exists in both the admin panel and File Manager plugin, allowing attackers to potentially access sensitive files or perform server-side request forgery attacks through maliciously crafted SVG files. This affects all Grav CMS installations running version 1.7.x or older versions.