PT-2025-51250 · Grav · Grav

Yohane-Mashiro · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-66844

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions grav versions prior to 1.7.49.5

Description A Server-Side Request Forgery (SSRF) issue exists in grav. The issue occurs when page content is processed by Twig templates, and the configuration allows undefined PHP functions to be registered. This can be triggered via Twig templates. SSRF allows an attacker to cause the server to make requests to unintended locations.

Recommendations Update grav to version 1.7.49.5 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-66844

GHSA-729W-J79F-2C34

Affected Products

Grav

References · 5

• 🔥 https://github.com/Yohane-Mashiro/grav_cve/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66844 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66844 · Vendor Advisory
• https://t.me/CVEtracker/39851 · Telegram Post
• https://twitter.com/CVEnew/status/2000611252490629522 · Twitter Post