Vulnerability · Published Dec 1, 2025 · Assigned by GitHub_M
CVE-2025-66294Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
High 8.7
In plain English
A high-severity code injection in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
Official description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | getgrav/grav | 1.8.0-beta.27 | GHSA-662m-56v4-3r8f |
Affected products (as reported)
Weakness: CWE-94, CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N