CVE-2025-66294

HIGH

Grav <1.8.0-beta.27 - SSTI

Title source: llm

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.

Exploits (1)

metasploit WORKING POC EXCELLENT

by Tarek Nakkouch · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb

View Code ZIP pw:eip

References (2)

[Patch] https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458

[Exploit, Vendor Advisory] https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f

Scores

CVSS v3 8.8

EPSS 0.4136

EPSS Percentile 97.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-1336 CWE-94

Status published

Products (3)

getgrav/grav 1.8.0 beta1 (26 CPE variants)

getgrav/grav 0 - 1.8.0-beta.27Packagist

getgrav/grav 1.7.48 - 1.8.0

Published Dec 01, 2025

Tracked Since Feb 18, 2026