PT-2025-48558 · Grav Cms · Grav Cms

Published 2025-12-01 · Updated 2025-12-03 · CVE-2025-66299

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27

Description Grav CMS is susceptible to a Server-Side Template Injection (SSTI) issue. An authenticated user with editor permissions can execute arbitrary code on the remote server, bypassing the security sandbox. The existing security sandbox does not fully protect the Twig object, allowing interaction through maliciously crafted Twig template directives. This enables an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe filters, effectively bypassing the Grav CMS sandbox.

Recommendations Update to Grav version 1.8.0-beta.27 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2025-66299

GHSA-GJC5-8CFH-653X

Affected Products

Grav Cms

References · 10

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-gjc5-8cfh-653x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66299.json · Exploit
• https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66299 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66299 · Vendor Advisory
• https://twitter.com/transilienceai/status/1995697188534395365 · Twitter Post
• https://twitter.com/CVEnew/status/1995607814962884713 · Twitter Post
• https://t.me/CVEtracker/38578 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995696663973769491 · Twitter Post
• https://twitter.com/dailycve/status/1996274182838264027 · Twitter Post