CVE-2025-66299 Details
Description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.
A server-side template injection vulnerability has been identified in Grav CMS versions prior to 1.8.0-beta.27. This vulnerability allows authenticated users with editor permissions to execute arbitrary code on the server, bypassing the existing security sandbox. The issue arises because the sandbox does not fully protect the Twig object, enabling manipulation through crafted Twig directives. Exploitation involves injecting directives that interact with the Twig environment, such as calling methods or accessing attributes, which can lead to unauthorized code execution.
Users are advised to update Grav CMS to version 1.8.0-beta.27 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458 | [email protected] | Patch |
| https://github.com/getgrav/grav/security/advisories/GHSA-gjc5-8cfh-653x | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getgrav grav | < 1.8.0 1.8.0 beta1 1.8.0 beta10 1.8.0 beta11 1.8.0 beta12 1.8.0 beta13 1.8.0 beta14 1.8.0 beta15 1.8.0 beta16 1.8.0 beta17 1.8.0 beta18 1.8.0 beta19 1.8.0 beta2 1.8.0 beta20 1.8.0 beta21 1.8.0 beta22 1.8.0 beta23 1.8.0 beta24 1.8.0 beta25 1.8.0 beta26 1.8.0 beta3 1.8.0 beta4 1.8.0 beta5 1.8.0 beta6 1.8.0 beta7 1.8.0 beta8 1.8.0 beta9 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Dec 1, 2025 | New CVE Received | [email protected] |