PT-2025-48569 · Unknown+1 · Grav Admin Plugin+1

Published 2025-12-01 · Updated 2025-12-04 · CVE-2025-66310

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.11.0-beta.1

Description The Grav admin plugin, an HTML user interface for configuring Grav and managing pages, contains a Stored Cross-Site Scripting (XSS) issue. An attacker can inject malicious scripts into the data[header][template] parameter of the /admin/pages/[page] API endpoint. The injected script is stored in the page's frontmatter and automatically executed when the content is rendered in the administrative interface or frontend view.

Recommendations Update to Grav version 1.11.0-beta.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66310

GHSA-7G78-5G5G-MVFJ

Affected Products

Grav

Grav Admin Plugin

References · 9

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-7g78-5g5g-mvfj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66310.json · Exploit
• https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0 · Patch
• https://osv.dev/vulnerability/CVE-2025-66310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66310 · Security Note
• https://twitter.com/CVEnew/status/1995622985064161606 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1pchx5n/resumen_diario_de_vulnerabilidades_02122025 · Reddit Post
• https://twitter.com/dailycve/status/1996389204146950553 · Twitter Post
• https://t.me/CVEtracker/38601 · Telegram Post