Vulnerability Description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Getgrav | Grav | >= 1.7.48, < 1.8.0 |
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458Patch
- https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8fExploitVendor Advisory
FAQ
What is CVE-2025-66294?
CVE-2025-66294 is a vulnerability with a CVSS score of 8.8 (HIGH). Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute a...
How severe is CVE-2025-66294?
CVE-2025-66294 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-66294?
Check the references section above for vendor advisories and patch information. Affected products include: Getgrav Grav.