PT-2025-48556 · Twig+2 · Twig+2

Published 2025-12-01 · Updated 2025-12-02 · CVE-2025-66297

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27

Description A user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, a user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This can lead to Privilege Escalation and Remote Code Execution.

Recommendations Update to version 1.8.0-beta.27 or later.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-66297

GHSA-858Q-77WX-HHX6

Affected Products

Grav

Grav Cms

Twig

References · 8

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66297.json · Exploit
• https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458 · Patch
• https://osv.dev/vulnerability/CVE-2025-66297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66297 · Security Note
• https://twitter.com/CVEnew/status/1995602410379641120 · Twitter Post
• https://t.me/CVEtracker/38589 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995706903641428381 · Twitter Post