1. Home
  2. CVE Database
  3. CVE-2025-66844
CRITICAL · 9.1

CVE-2025-66844

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be reg...

Vulnerability Description

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
GetgravGrav< 1.7.49.5

Related Weaknesses (CWE)

CWE-918

References

FAQ

What is CVE-2025-66844?

CVE-2025-66844 is a vulnerability with a CVSS score of 9.1 (CRITICAL). In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be reg...

How severe is CVE-2025-66844?

CVE-2025-66844 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-66844?

Check the references section above for vendor advisories and patch information. Affected products include: Getgrav Grav.