PT-2025-48561 · Grav Cms · Grav Cms

Published 2025-12-01 · Updated 2025-12-02 · CVE-2025-66302

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27

Description Grav CMS contains a path traversal flaw. Authenticated attackers with administrative privileges can read arbitrary files on the server filesystem. This is due to inadequate input sanitization within the backup tool, where user-provided paths are not sufficiently restricted, allowing access to files outside the webroot directory. The impact of this issue is dependent on the privileges of the user account running the application.

Recommendations Update to version 1.8.0-beta.27 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-66302

GHSA-J422-QMXP-HV94

Affected Products

Grav Cms

References · 8

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-j422-qmxp-hv94 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66302.json · Exploit
• https://github.com/getgrav/grav/commit/ed640a13143c4177af013cf001969ed2c5e197ee · Patch
• https://osv.dev/vulnerability/CVE-2025-66302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66302 · Security Note
• https://twitter.com/VulmonFeeds/status/1995688983448154539 · Twitter Post
• https://twitter.com/CVEnew/status/1995611525617160438 · Twitter Post
• https://t.me/CVEtracker/38593 · Telegram Post